# Flog Txt Version 1 # Analyzer Version: 2024.2.1 # Analyzer Build Date: Mar 23 2024 12:02:19 # Log Creation Date: 06.06.2024 22:28:59.206 Process: id = "1" image_name = "amd89270195629.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\amd89270195629.exe" page_root = "0x2f6a7000" os_pid = "0x1214" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc8c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 121 start_va = 0x90000 end_va = 0x93fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 122 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 123 start_va = 0xb0000 end_va = 0xb1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 124 start_va = 0x180000 end_va = 0x20dfff monitored = 1 entry_point = 0x20c00a region_type = mapped_file name = "amd89270195629.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\amd89270195629.exe") Region: id = 125 start_va = 0x210000 end_va = 0x211fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 126 start_va = 0x220000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 127 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 128 start_va = 0x77840000 end_va = 0x779bafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 129 start_va = 0x7e150000 end_va = 0x7e172fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e150000" filename = "" Region: id = 130 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 131 start_va = 0x7fff0000 end_va = 0x7ffb56e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 132 start_va = 0x7ffb56e50000 end_va = 0x7ffb57010fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 133 start_va = 0x7ffb57011000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb57011000" filename = "" Region: id = 272 start_va = 0x600000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 273 start_va = 0x52570000 end_va = 0x525bffff monitored = 0 entry_point = 0x52588180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 274 start_va = 0x524f0000 end_va = 0x52569fff monitored = 0 entry_point = 0x52503290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 275 start_va = 0x76b60000 end_va = 0x76c3ffff monitored = 0 entry_point = 0x76b73980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x525c0000 end_va = 0x525c7fff monitored = 0 entry_point = 0x525c17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 277 start_va = 0x600000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 278 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 279 start_va = 0x706b0000 end_va = 0x70708fff monitored = 1 entry_point = 0x706c0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 280 start_va = 0x76b60000 end_va = 0x76c3ffff monitored = 0 entry_point = 0x76b73980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 281 start_va = 0x771a0000 end_va = 0x7731dfff monitored = 0 entry_point = 0x77251b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 282 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 283 start_va = 0x7e050000 end_va = 0x7e14ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007e050000" filename = "" Region: id = 367 start_va = 0xc0000 end_va = 0x17dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 368 start_va = 0x7b0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 369 start_va = 0x744c0000 end_va = 0x74551fff monitored = 0 entry_point = 0x74500380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 370 start_va = 0x7dca0000 end_va = 0x7e040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 371 start_va = 0x210000 end_va = 0x213fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 372 start_va = 0x762c0000 end_va = 0x7633afff monitored = 0 entry_point = 0x762de970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 373 start_va = 0x74ad0000 end_va = 0x74b8dfff monitored = 0 entry_point = 0x74b05630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 374 start_va = 0x320000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 375 start_va = 0x7b0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 376 start_va = 0x8f0000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 377 start_va = 0x76ec0000 end_va = 0x76f03fff monitored = 0 entry_point = 0x76ed9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 378 start_va = 0x76dc0000 end_va = 0x76e6cfff monitored = 0 entry_point = 0x76dd4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 379 start_va = 0x74570000 end_va = 0x7458dfff monitored = 0 entry_point = 0x7457b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 380 start_va = 0x74560000 end_va = 0x74569fff monitored = 0 entry_point = 0x74562a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 381 start_va = 0x745b0000 end_va = 0x74607fff monitored = 0 entry_point = 0x745f25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 382 start_va = 0x360000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 383 start_va = 0x70630000 end_va = 0x706acfff monitored = 1 entry_point = 0x70640db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 384 start_va = 0x77320000 end_va = 0x77364fff monitored = 0 entry_point = 0x7733de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 385 start_va = 0x77370000 end_va = 0x7752cfff monitored = 0 entry_point = 0x77452a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 386 start_va = 0x76f10000 end_va = 0x7705efff monitored = 0 entry_point = 0x76fc6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 387 start_va = 0x77580000 end_va = 0x776c6fff monitored = 0 entry_point = 0x77591cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 388 start_va = 0x360000 end_va = 0x389fff monitored = 0 entry_point = 0x365680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 389 start_va = 0x3a0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 390 start_va = 0x900000 end_va = 0xa87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 391 start_va = 0x76930000 end_va = 0x7695afff monitored = 0 entry_point = 0x76935680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 392 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 393 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 394 start_va = 0xa90000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 395 start_va = 0xc20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 396 start_va = 0x2020000 end_va = 0x20a4fff monitored = 1 entry_point = 0x20ac00a region_type = mapped_file name = "amd89270195629.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\amd89270195629.exe") Region: id = 397 start_va = 0x74ac0000 end_va = 0x74acbfff monitored = 0 entry_point = 0x74ac3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 398 start_va = 0x70620000 end_va = 0x70627fff monitored = 0 entry_point = 0x706217b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 399 start_va = 0x2020000 end_va = 0x2700fff monitored = 1 entry_point = 0x204cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 400 start_va = 0x6f350000 end_va = 0x6fa30fff monitored = 1 entry_point = 0x6f37cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 401 start_va = 0x70520000 end_va = 0x70614fff monitored = 0 entry_point = 0x70574160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 402 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 403 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 404 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 405 start_va = 0x3b0000 end_va = 0x3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 406 start_va = 0x3c0000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 407 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 408 start_va = 0x3e0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 409 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 410 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 411 start_va = 0x630000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 412 start_va = 0x2020000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 413 start_va = 0x2020000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 414 start_va = 0x2190000 end_va = 0x219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 415 start_va = 0x730000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 416 start_va = 0x21a0000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 417 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 418 start_va = 0x22a0000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 419 start_va = 0x2020000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 420 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 421 start_va = 0x8b0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 422 start_va = 0x42a0000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 423 start_va = 0x43a0000 end_va = 0x46d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 424 start_va = 0x6e090000 end_va = 0x6f341fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 425 start_va = 0x76340000 end_va = 0x7642afff monitored = 0 entry_point = 0x7637d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 426 start_va = 0x46e0000 end_va = 0x4770fff monitored = 0 entry_point = 0x4718cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 427 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 428 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 429 start_va = 0x704a0000 end_va = 0x7051ffff monitored = 1 entry_point = 0x704a1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 430 start_va = 0x77070000 end_va = 0x77101fff monitored = 0 entry_point = 0x770a8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 431 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 432 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 433 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 434 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 435 start_va = 0x2100000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 436 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 437 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 438 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 439 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 440 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 441 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 442 start_va = 0x2100000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 443 start_va = 0x2180000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 444 start_va = 0x46e0000 end_va = 0x47dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 445 start_va = 0x47e0000 end_va = 0x57dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 446 start_va = 0x57e0000 end_va = 0x590ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000057e0000" filename = "" Region: id = 447 start_va = 0x5910000 end_va = 0x690ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 448 start_va = 0x6910000 end_va = 0x6b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006910000" filename = "" Region: id = 449 start_va = 0x780000 end_va = 0x780fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 450 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 451 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 452 start_va = 0x6b60000 end_va = 0x7b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 453 start_va = 0x7b60000 end_va = 0x8b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b60000" filename = "" Region: id = 454 start_va = 0x8b60000 end_va = 0x9b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008b60000" filename = "" Region: id = 455 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 456 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 457 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 458 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 459 start_va = 0x2140000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 460 start_va = 0x2150000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 461 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 462 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 463 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 464 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 465 start_va = 0x2140000 end_va = 0x217ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 466 start_va = 0x9b60000 end_va = 0x9c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009b60000" filename = "" Region: id = 467 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 468 start_va = 0x9c60000 end_va = 0x9c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009c60000" filename = "" Region: id = 469 start_va = 0x9ca0000 end_va = 0x9d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000009ca0000" filename = "" Region: id = 470 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 471 start_va = 0x74bf0000 end_va = 0x75feefff monitored = 0 entry_point = 0x74dab990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 472 start_va = 0x76d70000 end_va = 0x76da6fff monitored = 0 entry_point = 0x76d73b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 473 start_va = 0x76430000 end_va = 0x76928fff monitored = 0 entry_point = 0x76637610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 474 start_va = 0x76230000 end_va = 0x762bcfff monitored = 0 entry_point = 0x76279b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 475 start_va = 0x76e70000 end_va = 0x76eb3fff monitored = 0 entry_point = 0x76e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 476 start_va = 0x769c0000 end_va = 0x769cefff monitored = 0 entry_point = 0x769c2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 477 start_va = 0x790000 end_va = 0x790fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 478 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 479 start_va = 0x70460000 end_va = 0x7049dfff monitored = 1 entry_point = 0x7046c24e region_type = mapped_file name = "d3d9.dll" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\d3d9.dll") Region: id = 480 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 481 start_va = 0x9da0000 end_va = 0x9e7ffff monitored = 0 entry_point = 0x9db3980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 482 start_va = 0x9e80000 end_va = 0x9ffafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 499 start_va = 0x20c0000 end_va = 0x20c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Thread: id = 1 os_tid = 0x1230 [0185.859] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0186.031] RoInitialize () returned 0x1 [0186.031] RoUninitialize () returned 0x0 [0186.521] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x31d480 | out: phkResult=0x31d480*=0x0) returned 0x2 [0186.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", nBufferLength=0x105, lpBuffer=0x31e4f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", lpFilePart=0x0) returned 0x30 [0186.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", nBufferLength=0x105, lpBuffer=0x31e470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", lpFilePart=0x0) returned 0x30 [0186.566] VirtualProtect (in: lpAddress=0x182000, dwSize=0x3b990, flNewProtect=0x40, lpflOldProtect=0x31eab8 | out: lpflOldProtect=0x31eab8*=0x2) returned 1 [0187.779] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x600, lpName=0x0) returned 0x284 [0187.780] memcpy (in: _Dst=0x780000, _Src=0x22ac0ec, _Size=0x600 | out: _Dst=0x780000) returned 0x780000 [0187.780] CloseHandle (hObject=0x284) returned 1 [0188.816] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", nBufferLength=0x105, lpBuffer=0x31e3c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", lpFilePart=0x0) returned 0x30 [0188.817] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", nBufferLength=0x105, lpBuffer=0x31e338, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", lpFilePart=0x0) returned 0x30 [0188.850] VirtualProtect (in: lpAddress=0x1be78e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x2) returned 1 [0188.851] VirtualProtect (in: lpAddress=0x1be782, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.852] VirtualProtect (in: lpAddress=0x180178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x2) returned 1 [0188.865] VirtualProtect (in: lpAddress=0x1801a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.866] VirtualProtect (in: lpAddress=0x1801c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.866] VirtualProtect (in: lpAddress=0x1801f0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.867] VirtualProtect (in: lpAddress=0x180218, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.867] VirtualProtect (in: lpAddress=0x1be000, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.867] VirtualProtect (in: lpAddress=0x1be79c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.868] VirtualProtect (in: lpAddress=0x1be7bc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.868] VirtualProtect (in: lpAddress=0x1be7c4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.868] VirtualProtect (in: lpAddress=0x1be7c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.869] VirtualProtect (in: lpAddress=0x1be7d0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.869] VirtualProtect (in: lpAddress=0x1be7d4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.869] VirtualProtect (in: lpAddress=0x1be7d8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.870] VirtualProtect (in: lpAddress=0x1be7dc, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.870] VirtualProtect (in: lpAddress=0x1be7e4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.870] VirtualProtect (in: lpAddress=0x1be7e8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.871] VirtualProtect (in: lpAddress=0x1be7ec, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.871] VirtualProtect (in: lpAddress=0x1be7f4, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0188.871] VirtualProtect (in: lpAddress=0x1be7f8, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x31eae4 | out: lpflOldProtect=0x31eae4*=0x40) returned 1 [0189.125] GetEnvironmentVariableW (in: lpName="COR_ENABLE_PROFILING", lpBuffer=0x31e55c, nSize=0x80 | out: lpBuffer="") returned 0x0 [0190.897] CoTaskMemAlloc (cb=0x20c) returned 0x689eb8 [0190.897] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x689eb8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0190.914] CoTaskMemFree (pv=0x689eb8) [0190.915] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x31ed48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0190.944] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", nBufferLength=0x105, lpBuffer=0x31ede4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", lpFilePart=0x0) returned 0x2e [0190.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x31f28c) returned 1 [0190.951] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\d3d9.dll"), fInfoLevelId=0x0, lpFileInformation=0x31f308 | out: lpFileInformation=0x31f308*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0190.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x31f288) returned 1 [0191.043] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", nBufferLength=0x105, lpBuffer=0x31eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", lpFilePart=0x0) returned 0x2e [0191.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x31f204) returned 1 [0191.045] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\d3d9.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0191.059] GetFileType (hFile=0x320) returned 0x1 [0191.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x31f200) returned 1 [0191.059] GetFileType (hFile=0x320) returned 0x1 [0191.059] WriteFile (in: hFile=0x320, lpBuffer=0x3bd2418*, nNumberOfBytesToWrite=0x3ac00, lpNumberOfBytesWritten=0x31f2b4, lpOverlapped=0x0 | out: lpBuffer=0x3bd2418*, lpNumberOfBytesWritten=0x31f2b4*=0x3ac00, lpOverlapped=0x0) returned 1 [0191.073] CloseHandle (hObject=0x320) returned 1 [0191.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", nBufferLength=0x105, lpBuffer=0x31edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", lpFilePart=0x0) returned 0x2e [0191.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x31f2a0) returned 1 [0191.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\d3d9.dll"), fInfoLevelId=0x0, lpFileInformation=0x31f31c | out: lpFileInformation=0x31f31c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e10d913, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x5e10d913, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x5e15b5d5, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x3ac00)) returned 1 [0191.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x31f29c) returned 1 [0191.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", nBufferLength=0x105, lpBuffer=0x31ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", lpFilePart=0x0) returned 0x2e [0191.097] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll", dwFileAttributes=0x22) returned 1 [0191.117] LoadLibraryW (lpLibFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\d3d9.dll") returned 0x70460000 [0191.143] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0191.144] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x771a0000 [0191.144] GetProcAddress (hModule=0x771a0000, lpProcName="InitializeCriticalSectionEx") returned 0x7725d740 [0191.144] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x771a0000 [0191.145] GetProcAddress (hModule=0x771a0000, lpProcName="FlsAlloc") returned 0x77264490 [0191.145] GetProcAddress (hModule=0x771a0000, lpProcName="FlsSetValue") returned 0x7725d7a0 [0191.147] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x771a0000 [0191.147] GetProcAddress (hModule=0x771a0000, lpProcName="InitializeCriticalSectionEx") returned 0x7725d740 [0191.148] GetProcessHeap () returned 0x630000 [0191.148] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x771a0000 [0191.148] GetProcAddress (hModule=0x771a0000, lpProcName="FlsAlloc") returned 0x77264490 [0191.148] GetLastError () returned 0x0 [0191.148] GetProcAddress (hModule=0x771a0000, lpProcName="FlsGetValue") returned 0x7724f350 [0191.148] GetProcAddress (hModule=0x771a0000, lpProcName="FlsSetValue") returned 0x7725d7a0 [0191.148] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x364) returned 0x689f78 [0191.149] SetLastError (dwErrCode=0x0) [0191.150] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe00) returned 0x690e08 [0191.153] GetStartupInfoW (in: lpStartupInfo=0x31ee44 | out: lpStartupInfo=0x31ee44*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x7046d220, hStdOutput=0xbbcdc983, hStdError=0xfffffffe)) [0191.153] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0191.153] GetFileType (hFile=0x38) returned 0x2 [0191.153] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0191.153] GetFileType (hFile=0x3c) returned 0x2 [0191.153] GetStdHandle (nStdHandle=0xfffffff4) returned 0x40 [0191.153] GetFileType (hFile=0x40) returned 0x2 [0191.153] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe\" " [0191.154] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe\" " [0191.154] GetACP () returned 0x4e4 [0191.154] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x220) returned 0x691c10 [0191.154] IsValidCodePage (CodePage=0x4e4) returned 1 [0191.154] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x31ec38 | out: lpCPInfo=0x31ec38) returned 1 [0191.154] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x31e4fc | out: lpCPInfo=0x31e4fc) returned 1 [0191.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0191.154] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x31e298, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㳻灇ᰐiĀ") returned 256 [0191.154] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㳻灇ᰐiĀ", cchSrc=256, lpCharType=0x31e510 | out: lpCharType=0x31e510) returned 1 [0191.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0191.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x31e248, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0191.155] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x771a0000 [0191.155] GetProcAddress (hModule=0x771a0000, lpProcName="LCMapStringEx") returned 0x772495f0 [0191.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0191.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x31e038, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0191.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x31ea10, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", lpUsedDefaultChar=0x0) returned 256 [0191.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0191.155] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", cbMultiByte=256, lpWideCharStr=0x31e268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸯灇ᰐiĀ") returned 256 [0191.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸯灇ᰐiĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0191.155] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㸯灇ᰐiĀ", cchSrc=256, lpDestStr=0x31e058, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0191.156] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x31e910, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ·þ»ËPì1", lpUsedDefaultChar=0x0) returned 256 [0191.156] RtlInitializeSListHead (in: ListHead=0x7049b220 | out: ListHead=0x7049b220) [0191.156] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x800) returned 0x691e38 [0191.157] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0191.157] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31eca8, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\amd89270195629.exe")) returned 0x30 [0191.157] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x76b60000 [0191.157] GetProcAddress (hModule=0x76b60000, lpProcName="AreFileApisANSI") returned 0x76b7f300 [0191.157] AreFileApisANSI () returned 1 [0191.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0191.157] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", cchWideChar=-1, lpMultiByteStr=0x7049b320, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\AMD89270195629.exe", lpUsedDefaultChar=0x0) returned 49 [0191.157] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x39) returned 0x66bfa8 [0191.157] GetEnvironmentStringsW () returned 0x692640* [0191.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1351 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x0, Size=0x547) returned 0x6930d8 [0191.158] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1351, lpMultiByteStr=0x6930d8, cbMultiByte=1351, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1351 [0191.158] FreeEnvironmentStringsW (penv=0x692640) returned 1 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x90) returned 0x684ac8 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1f) returned 0x68c6d0 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2e) returned 0x680690 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x37) returned 0x68f840 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3c) returned 0x66c230 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x31) returned 0x68fac0 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x14) returned 0x675138 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x24) returned 0x680f30 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xd) returned 0x6824d8 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1d) returned 0x68c6f8 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x31) returned 0x68fb00 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x15) returned 0x675318 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x17) returned 0x675278 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xe) returned 0x682418 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xa2) returned 0x693628 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x3e) returned 0x66c308 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1b) returned 0x68c428 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1d) returned 0x68c720 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x49) returned 0x6454e8 [0191.158] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x12) returned 0x6752f8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x18) returned 0x675158 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1b) returned 0x68c4c8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x24) returned 0x6813e0 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x29) returned 0x680118 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x1e) returned 0x68c4f0 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x6b) returned 0x67aeb8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x17) returned 0x674ff8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0xf) returned 0x6824c0 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x16) returned 0x6750f8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x2a) returned 0x680038 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x29) returned 0x680578 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x12) returned 0x6751d8 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x21) returned 0x681050 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x16) returned 0x675198 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x22) returned 0x681200 [0191.159] RtlAllocateHeap (HeapHandle=0x630000, Flags=0x8, Size=0x12) returned 0x6751b8 [0191.160] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x6930d8 | out: hHeap=0x630000) returned 1 [0191.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="HonorInc", cchWideChar=8, lpMultiByteStr=0x31f2f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HonorInc©\x7fb", lpUsedDefaultChar=0x0) returned 8 [0191.270] GetProcAddress (hModule=0x70460000, lpProcName="HonorInc") returned 0x70462eb0 [0191.403] GetConsoleWindow () returned 0x60044 [0191.404] ShowWindow (hWnd=0x60044, nCmdShow=0) returned 1 [0191.485] GetCurrentProcess () returned 0xffffffff [0191.486] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76b60000 [0191.486] K32GetModuleInformation (in: hProcess=0xffffffff, hModule=0x76b60000, lpmodinfo=0x31f048, cb=0xc | out: lpmodinfo=0x31f048*(lpBaseOfDll=0x76b60000, SizeOfImage=0xe0000, EntryPoint=0x76b73980)) returned 1 [0191.486] GetModuleFileNameA (in: hModule=0x76b60000, lpFilename=0x31f054, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0191.486] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0191.487] CreateFileMappingA (hFile=0x320, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x314 [0191.487] MapViewOfFile (hFileMappingObject=0x314, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x9da0000 [0191.487] VirtualProtect (in: lpAddress=0x76b70000, dwSize=0x6556d, flNewProtect=0x40, lpflOldProtect=0x31efac | out: lpflOldProtect=0x31efac*=0x20) returned 1 [0194.404] VirtualProtect (in: lpAddress=0x76b70000, dwSize=0x6556d, flNewProtect=0x20, lpflOldProtect=0x31efac | out: lpflOldProtect=0x31efac*=0x40) returned 1 [0194.414] CloseHandle (hObject=0x320) returned 1 [0194.419] CloseHandle (hObject=0x314) returned 1 [0194.421] CloseHandle (hObject=0xffffffff) returned 1 [0194.425] GetCurrentProcess () returned 0xffffffff [0194.428] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77840000 [0194.431] K32GetModuleInformation (in: hProcess=0xffffffff, hModule=0x77840000, lpmodinfo=0x31f048, cb=0xc | out: lpmodinfo=0x31f048*(lpBaseOfDll=0x77840000, SizeOfImage=0x17b000, EntryPoint=0x0)) returned 1 [0194.435] GetModuleFileNameA (in: hModule=0x77840000, lpFilename=0x31f054, nSize=0x104 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0194.437] CreateFileA (lpFileName="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0194.457] CreateFileMappingA (hFile=0x314, lpFileMappingAttributes=0x0, flProtect=0x1000002, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x320 [0194.460] MapViewOfFile (hFileMappingObject=0x320, dwDesiredAccess=0x4, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x9e80000 [0194.464] VirtualProtect (in: lpAddress=0x77841000, dwSize=0x1042aa, flNewProtect=0x40, lpflOldProtect=0x31efac | out: lpflOldProtect=0x31efac*=0x20) returned 1 [0200.692] VirtualProtect (in: lpAddress=0x77841000, dwSize=0x1042aa, flNewProtect=0x20, lpflOldProtect=0x31efac | out: lpflOldProtect=0x31efac*=0x40) returned 1 [0200.990] CloseHandle (hObject=0x314) returned 1 [0200.993] CloseHandle (hObject=0x320) returned 1 [0200.996] CloseHandle (hObject=0xffffffff) returned 1 [0201.039] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x31f2cc*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f310 | out: lpCommandLine=0x0, lpProcessInformation=0x31f310*(hProcess=0x314, hThread=0x320, dwProcessId=0xad0, dwThreadId=0x1350)) returned 1 [0201.101] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x4) returned 0x20c0000 [0201.105] GetThreadContext (in: hThread=0x320, lpContext=0x20c0000 | out: lpContext=0x20c0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x5ed000, Edx=0x0, Ecx=0x0, Eax=0x3b9a6e, Ebp=0x0, Eip=0x778b8fe0, SegCs=0x23, EFlags=0x202, Esp=0x18f848, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0201.118] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x77840000 [0201.121] GetProcAddress (hModule=0x77840000, lpProcName="NtQueryInformationProcess") returned 0x778b6e10 [0201.138] NtQueryInformationProcess (in: ProcessHandle=0x314, ProcessInformationClass=0x0, ProcessInformation=0x31f104, ProcessInformationLength=0x18, ReturnLength=0x31f100 | out: ProcessInformation=0x31f104, ReturnLength=0x31f100) returned 0x0 [0201.142] VirtualAllocEx (hProcess=0x314, lpAddress=0x400000, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x0 [0201.148] VirtualAllocEx (hProcess=0x314, lpAddress=0x0, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x3d0000 [0201.151] WriteProcessMemory (in: hProcess=0x314, lpBaseAddress=0x3d0000, lpBuffer=0x7047f000*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7047f000*, lpNumberOfBytesWritten=0x0) returned 1 [0201.158] WriteProcessMemory (in: hProcess=0x314, lpBaseAddress=0x3d2000, lpBuffer=0x7047f200*, nSize=0x1ac00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7047f200*, lpNumberOfBytesWritten=0x0) returned 1 [0201.284] WriteProcessMemory (in: hProcess=0x314, lpBaseAddress=0x3ee000, lpBuffer=0x70499e00*, nSize=0x600, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x70499e00*, lpNumberOfBytesWritten=0x0) returned 1 [0201.292] WriteProcessMemory (in: hProcess=0x314, lpBaseAddress=0x3f0000, lpBuffer=0x7049a400*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7049a400*, lpNumberOfBytesWritten=0x0) returned 1 [0201.304] WriteProcessMemory (in: hProcess=0x314, lpBaseAddress=0x5ed008, lpBuffer=0x31f1cc*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x31f1cc*, lpNumberOfBytesWritten=0x0) returned 1 [0201.310] SetThreadContext (hThread=0x320, lpContext=0x20c0000*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x5ed000, Edx=0x0, Ecx=0x0, Eax=0x3ecb5e, Ebp=0x0, Eip=0x778b8fe0, SegCs=0x23, EFlags=0x202, Esp=0x18f848, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0201.319] ResumeThread (hThread=0x320) returned 0x1 [0201.406] CloseHandle (hObject=0x320) returned 1 [0201.409] CloseHandle (hObject=0x314) returned 1 [0202.328] WaitForSingleObject (hHandle=0x70460000, dwMilliseconds=0xffffffff) returned 0xffffffff [0203.291] CloseHandle (hObject=0x70460000) returned 0 [0203.347] CoGetContextToken (in: pToken=0x31fc50 | out: pToken=0x31fc50) returned 0x0 [0203.347] CObjectContext::QueryInterface () returned 0x0 [0203.348] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.348] Release () returned 0x0 [0203.417] CoGetContextToken (in: pToken=0x31f96c | out: pToken=0x31f96c) returned 0x0 [0203.418] CObjectContext::QueryInterface () returned 0x0 [0203.418] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.418] Release () returned 0x0 [0203.454] CoGetContextToken (in: pToken=0x31f96c | out: pToken=0x31f96c) returned 0x0 [0203.454] CObjectContext::QueryInterface () returned 0x0 [0203.454] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.454] Release () returned 0x0 [0203.603] CoGetContextToken (in: pToken=0x31f96c | out: pToken=0x31f96c) returned 0x0 [0203.604] CObjectContext::QueryInterface () returned 0x0 [0203.604] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.604] Release () returned 0x0 [0203.791] CoGetContextToken (in: pToken=0x31f984 | out: pToken=0x31f984) returned 0x0 [0203.791] CObjectContext::QueryInterface () returned 0x0 [0203.791] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.791] Release () returned 0x0 [0203.927] CoUninitialize () [0204.112] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x689f78 | out: hHeap=0x630000) returned 1 [0204.222] HeapFree (in: hHeap=0x630000, dwFlags=0x0, lpMem=0x691e38 | out: hHeap=0x630000) returned 1 [0204.232] RtlInterlockedFlushSList (in: ListHead=0x7049b220 | out: ListHead=0x7049b220) returned 0x0 [0204.235] GetProcAddress (hModule=0x771a0000, lpProcName="FlsFree") returned 0x77265f30 [0204.237] GetProcAddress (hModule=0x771a0000, lpProcName="FlsFree") returned 0x77265f30 Thread: id = 6 os_tid = 0x1278 Thread: id = 7 os_tid = 0x12a0 Thread: id = 8 os_tid = 0x12bc [0186.212] CoGetContextToken (in: pToken=0x439fad4 | out: pToken=0x439fad4) returned 0x0 [0186.213] CObjectContext::QueryInterface () returned 0x0 [0186.213] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.213] Release () returned 0x0 [0186.213] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0186.213] RoInitialize () returned 0x1 [0186.213] RoUninitialize () returned 0x0 [0203.627] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 9 os_tid = 0x129c Thread: id = 10 os_tid = 0x12b0 [0189.217] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0189.217] RoInitialize () returned 0x1 [0189.217] RoUninitialize () returned 0x0 [0203.801] CoGetContextToken (in: pToken=0x9c5f284 | out: pToken=0x9c5f284) returned 0x0 [0203.801] CObjectContext::QueryInterface () returned 0x0 [0203.801] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.801] Release () returned 0x0 Thread: id = 11 os_tid = 0x12a8 [0190.864] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0190.864] RoInitialize () returned 0x1 [0190.864] RoUninitialize () returned 0x0 [0203.996] CoGetContextToken (in: pToken=0x9d9eec4 | out: pToken=0x9d9eec4) returned 0x0 [0203.996] CObjectContext::QueryInterface () returned 0x0 [0203.997] CObjectContext::GetCurrentThreadType () returned 0x0 [0203.997] Release () returned 0x0 Process: id = "2" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x31882000" os_pid = "0x1224" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1214" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc8c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 284 start_va = 0x1000000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 285 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 286 start_va = 0x1600f50000 end_va = 0x1600f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001600f50000" filename = "" Region: id = 287 start_va = 0x1601000000 end_va = 0x16011fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001601000000" filename = "" Region: id = 288 start_va = 0x12f85670000 end_va = 0x12f8568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85670000" filename = "" Region: id = 289 start_va = 0x12f85690000 end_va = 0x12f856a4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85690000" filename = "" Region: id = 290 start_va = 0x7df5ff020000 end_va = 0x7ff5ff01ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff020000" filename = "" Region: id = 291 start_va = 0x7ff77c7b0000 end_va = 0x7ff77c7d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff77c7b0000" filename = "" Region: id = 292 start_va = 0x7ff77c7e0000 end_va = 0x7ff77c7f0fff monitored = 0 entry_point = 0x7ff77c7e16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 293 start_va = 0x7ffb56e50000 end_va = 0x7ffb57010fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 294 start_va = 0x12f856b0000 end_va = 0x12f8583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f856b0000" filename = "" Region: id = 295 start_va = 0x7ffb55050000 end_va = 0x7ffb550fcfff monitored = 0 entry_point = 0x7ffb550681a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 296 start_va = 0x7ffb53b70000 end_va = 0x7ffb53d57fff monitored = 0 entry_point = 0x7ffb53b9ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 297 start_va = 0x12f85670000 end_va = 0x12f8567ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85670000" filename = "" Region: id = 298 start_va = 0x7ff77c6b0000 end_va = 0x7ff77c7affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff77c6b0000" filename = "" Region: id = 299 start_va = 0x12f85840000 end_va = 0x12f858fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 300 start_va = 0x7ffb54840000 end_va = 0x7ffb548dcfff monitored = 0 entry_point = 0x7ffb548478a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 301 start_va = 0x1600f90000 end_va = 0x1600fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001600f90000" filename = "" Region: id = 302 start_va = 0x12f85900000 end_va = 0x12f85a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85900000" filename = "" Region: id = 303 start_va = 0x12f85680000 end_va = 0x12f85686fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85680000" filename = "" Region: id = 304 start_va = 0x7ffb3fa30000 end_va = 0x7ffb3fa88fff monitored = 0 entry_point = 0x7ffb3fa3fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 305 start_va = 0x12f856b0000 end_va = 0x12f856b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f856b0000" filename = "" Region: id = 306 start_va = 0x12f85740000 end_va = 0x12f8583ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85740000" filename = "" Region: id = 307 start_va = 0x7ffb543d0000 end_va = 0x7ffb5464cfff monitored = 0 entry_point = 0x7ffb544a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 308 start_va = 0x7ffb55160000 end_va = 0x7ffb5527bfff monitored = 0 entry_point = 0x7ffb551a02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 309 start_va = 0x7ffb540d0000 end_va = 0x7ffb54139fff monitored = 0 entry_point = 0x7ffb54106d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 310 start_va = 0x7ffb54680000 end_va = 0x7ffb547d5fff monitored = 0 entry_point = 0x7ffb5468a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 311 start_va = 0x7ffb548e0000 end_va = 0x7ffb54a65fff monitored = 0 entry_point = 0x7ffb5492ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 312 start_va = 0x12f856c0000 end_va = 0x12f856c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f856c0000" filename = "" Region: id = 313 start_va = 0x7ffb54e50000 end_va = 0x7ffb54f92fff monitored = 0 entry_point = 0x7ffb54e78210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 314 start_va = 0x7ffb55100000 end_va = 0x7ffb5515afff monitored = 0 entry_point = 0x7ffb551138b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 315 start_va = 0x7ffb56da0000 end_va = 0x7ffb56ddafff monitored = 0 entry_point = 0x7ffb56da12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 316 start_va = 0x7ffb56cd0000 end_va = 0x7ffb56d90fff monitored = 0 entry_point = 0x7ffb56cf0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 317 start_va = 0x7ffb519f0000 end_va = 0x7ffb51b75fff monitored = 0 entry_point = 0x7ffb51a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 318 start_va = 0x12f856d0000 end_va = 0x12f856d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f856d0000" filename = "" Region: id = 319 start_va = 0x12f856e0000 end_va = 0x12f856e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f856e0000" filename = "" Region: id = 320 start_va = 0x12f85a60000 end_va = 0x12f85be7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85a60000" filename = "" Region: id = 321 start_va = 0x12f85bf0000 end_va = 0x12f85d70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85bf0000" filename = "" Region: id = 322 start_va = 0x12f85d80000 end_va = 0x12f8717ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85d80000" filename = "" Region: id = 323 start_va = 0x12f87180000 end_va = 0x12f8733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87180000" filename = "" Region: id = 324 start_va = 0x1601200000 end_va = 0x160123ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001601200000" filename = "" Region: id = 325 start_va = 0x7ffb55770000 end_va = 0x7ffb56ccefff monitored = 0 entry_point = 0x7ffb558d11f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 326 start_va = 0x7ffb54200000 end_va = 0x7ffb54242fff monitored = 0 entry_point = 0x7ffb54214b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 327 start_va = 0x7ffb53520000 end_va = 0x7ffb53b63fff monitored = 0 entry_point = 0x7ffb536e64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 328 start_va = 0x7ffb54fa0000 end_va = 0x7ffb55046fff monitored = 0 entry_point = 0x7ffb54fb58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 329 start_va = 0x7ffb56df0000 end_va = 0x7ffb56e41fff monitored = 0 entry_point = 0x7ffb56dff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 330 start_va = 0x7ffb53470000 end_va = 0x7ffb5347efff monitored = 0 entry_point = 0x7ffb53473210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 331 start_va = 0x7ffb54140000 end_va = 0x7ffb541f4fff monitored = 0 entry_point = 0x7ffb541822e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 332 start_va = 0x7ffb53480000 end_va = 0x7ffb534cafff monitored = 0 entry_point = 0x7ffb534835f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 333 start_va = 0x7ffb534d0000 end_va = 0x7ffb534e3fff monitored = 0 entry_point = 0x7ffb534d52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 334 start_va = 0x7ffb51df0000 end_va = 0x7ffb51e85fff monitored = 0 entry_point = 0x7ffb51e15570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 335 start_va = 0x12f87340000 end_va = 0x12f874fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87340000" filename = "" Region: id = 336 start_va = 0x12f87500000 end_va = 0x12f87836fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 337 start_va = 0x12f87840000 end_va = 0x12f87a50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87840000" filename = "" Region: id = 338 start_va = 0x12f87a60000 end_va = 0x12f87c7efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87a60000" filename = "" Region: id = 339 start_va = 0x12f85900000 end_va = 0x12f85a15fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85900000" filename = "" Region: id = 340 start_va = 0x12f85a50000 end_va = 0x12f85a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85a50000" filename = "" Region: id = 341 start_va = 0x12f87c80000 end_va = 0x12f87e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87c80000" filename = "" Region: id = 342 start_va = 0x12f87180000 end_va = 0x12f87297fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87180000" filename = "" Region: id = 343 start_va = 0x12f87330000 end_va = 0x12f8733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f87330000" filename = "" Region: id = 344 start_va = 0x1601240000 end_va = 0x160127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001601240000" filename = "" Region: id = 345 start_va = 0x7ffb54ae0000 end_va = 0x7ffb54c39fff monitored = 0 entry_point = 0x7ffb54b238e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 346 start_va = 0x12f856f0000 end_va = 0x12f856f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f856f0000" filename = "" Region: id = 347 start_va = 0x12f87340000 end_va = 0x12f873fbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f87340000" filename = "" Region: id = 348 start_va = 0x12f874f0000 end_va = 0x12f874fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f874f0000" filename = "" Region: id = 349 start_va = 0x12f856f0000 end_va = 0x12f856f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f856f0000" filename = "" Region: id = 350 start_va = 0x7ffb514f0000 end_va = 0x7ffb51511fff monitored = 0 entry_point = 0x7ffb514f1a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 351 start_va = 0x7ffb51be0000 end_va = 0x7ffb51bf2fff monitored = 0 entry_point = 0x7ffb51be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 352 start_va = 0x7ffb53280000 end_va = 0x7ffb532d5fff monitored = 0 entry_point = 0x7ffb53290bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 353 start_va = 0x12f85700000 end_va = 0x12f85706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f85700000" filename = "" Region: id = 354 start_va = 0x12f85710000 end_va = 0x12f85710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85710000" filename = "" Region: id = 355 start_va = 0x12f85720000 end_va = 0x12f85720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85720000" filename = "" Region: id = 356 start_va = 0x12f85730000 end_va = 0x12f85734fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 357 start_va = 0x12f85a20000 end_va = 0x12f85a20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 358 start_va = 0x12f85a30000 end_va = 0x12f85a31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85a30000" filename = "" Region: id = 359 start_va = 0x12f87ea0000 end_va = 0x12f88095fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f87ea0000" filename = "" Region: id = 360 start_va = 0x7ffb48250000 end_va = 0x7ffb484c3fff monitored = 0 entry_point = 0x7ffb482c0400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 361 start_va = 0x12f85a40000 end_va = 0x12f85a40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 362 start_va = 0x12f872a0000 end_va = 0x12f872a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f872a0000" filename = "" Region: id = 363 start_va = 0x12f87400000 end_va = 0x12f874dcfff monitored = 0 entry_point = 0x12f8745e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 364 start_va = 0x12f85a40000 end_va = 0x12f85a40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f85a40000" filename = "" Region: id = 365 start_va = 0x12f880a0000 end_va = 0x12f8819ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000012f880a0000" filename = "" Region: id = 366 start_va = 0x12f881a0000 end_va = 0x12f8839efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000012f881a0000" filename = "" Thread: id = 2 os_tid = 0x1218 Thread: id = 3 os_tid = 0x1210 Thread: id = 4 os_tid = 0x127c Thread: id = 5 os_tid = 0x12ac Process: id = "3" image_name = "msbuild.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe" page_root = "0x2533a000" os_pid = "0xad0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x1214" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fc8c" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 483 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 484 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 485 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 486 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 487 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 488 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 489 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 490 start_va = 0x380000 end_va = 0x3bffff monitored = 0 entry_point = 0x3b9a6e region_type = mapped_file name = "msbuild.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe") Region: id = 491 start_va = 0x3c0000 end_va = 0x3c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 492 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 493 start_va = 0x77840000 end_va = 0x779bafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 494 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 495 start_va = 0xff420000 end_va = 0xff442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff420000" filename = "" Region: id = 496 start_va = 0xfffe0000 end_va = 0x7ffb56e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 497 start_va = 0x7ffb56e50000 end_va = 0x7ffb57010fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 498 start_va = 0x7ffb57011000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb57011000" filename = "" Region: id = 500 start_va = 0x3d0000 end_va = 0x3f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 501 start_va = 0x1c0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 502 start_va = 0x52570000 end_va = 0x525bffff monitored = 0 entry_point = 0x52588180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 503 start_va = 0x524f0000 end_va = 0x52569fff monitored = 0 entry_point = 0x52503290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 504 start_va = 0x76b60000 end_va = 0x76c3ffff monitored = 0 entry_point = 0x76b73980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 505 start_va = 0x525c0000 end_va = 0x525c7fff monitored = 0 entry_point = 0x525c17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 506 start_va = 0x600000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 507 start_va = 0x706b0000 end_va = 0x70708fff monitored = 1 entry_point = 0x706c0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 508 start_va = 0x76b60000 end_va = 0x76c3ffff monitored = 0 entry_point = 0x76b73980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 509 start_va = 0x771a0000 end_va = 0x7731dfff monitored = 0 entry_point = 0x77251b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 510 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 511 start_va = 0xff320000 end_va = 0xff41ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ff320000" filename = "" Region: id = 512 start_va = 0x1e0000 end_va = 0x29dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 513 start_va = 0x750000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 514 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 515 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 516 start_va = 0x3c0000 end_va = 0x3c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 517 start_va = 0x762c0000 end_va = 0x7633afff monitored = 0 entry_point = 0x762de970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 518 start_va = 0x74ad0000 end_va = 0x74b8dfff monitored = 0 entry_point = 0x74b05630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 519 start_va = 0x2a0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 520 start_va = 0x750000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 521 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 522 start_va = 0x76ec0000 end_va = 0x76f03fff monitored = 0 entry_point = 0x76ed9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 523 start_va = 0x76dc0000 end_va = 0x76e6cfff monitored = 0 entry_point = 0x76dd4f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 524 start_va = 0x74570000 end_va = 0x7458dfff monitored = 0 entry_point = 0x7457b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 525 start_va = 0x74560000 end_va = 0x74569fff monitored = 0 entry_point = 0x74562a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 526 start_va = 0x745b0000 end_va = 0x74607fff monitored = 0 entry_point = 0x745f25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 527 start_va = 0x8b0000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 528 start_va = 0x70630000 end_va = 0x706acfff monitored = 1 entry_point = 0x70640db0 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 529 start_va = 0x77320000 end_va = 0x77364fff monitored = 0 entry_point = 0x7733de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 530 start_va = 0x77370000 end_va = 0x7752cfff monitored = 0 entry_point = 0x77452a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 531 start_va = 0x76f10000 end_va = 0x7705efff monitored = 0 entry_point = 0x76fc6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 532 start_va = 0x77580000 end_va = 0x776c6fff monitored = 0 entry_point = 0x77591cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 533 start_va = 0x600000 end_va = 0x629fff monitored = 0 entry_point = 0x605680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 534 start_va = 0x650000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 535 start_va = 0x970000 end_va = 0xaf7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000970000" filename = "" Region: id = 536 start_va = 0x76930000 end_va = 0x7695afff monitored = 0 entry_point = 0x76935680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 537 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 538 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 539 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 540 start_va = 0xb00000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b00000" filename = "" Region: id = 541 start_va = 0xc90000 end_va = 0x208ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c90000" filename = "" Region: id = 542 start_va = 0x74ac0000 end_va = 0x74acbfff monitored = 0 entry_point = 0x74ac3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 543 start_va = 0x70620000 end_va = 0x70627fff monitored = 0 entry_point = 0x706217b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 544 start_va = 0x6f350000 end_va = 0x6fa30fff monitored = 1 entry_point = 0x6f37cd70 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 545 start_va = 0x70520000 end_va = 0x70614fff monitored = 0 entry_point = 0x70574160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 546 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 547 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 548 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 549 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 550 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 551 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 552 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 553 start_va = 0x870000 end_va = 0x870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 554 start_va = 0x880000 end_va = 0x880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 555 start_va = 0x8b0000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 556 start_va = 0x960000 end_va = 0x96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 557 start_va = 0x2090000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 558 start_va = 0x2e0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 559 start_va = 0x2140000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 560 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 561 start_va = 0x2240000 end_va = 0x423ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 562 start_va = 0x2090000 end_va = 0x212ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002090000" filename = "" Region: id = 563 start_va = 0x2130000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 564 start_va = 0x320000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 565 start_va = 0x4240000 end_va = 0x433ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 566 start_va = 0x4340000 end_va = 0x4676fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 567 start_va = 0x6e090000 end_va = 0x6f341fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\7582400666d289c016013ad0f6e0e3e6\\mscorlib.ni.dll") Region: id = 568 start_va = 0x76340000 end_va = 0x7642afff monitored = 0 entry_point = 0x7637d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 569 start_va = 0x4680000 end_va = 0x4710fff monitored = 0 entry_point = 0x46b8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 570 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 571 start_va = 0x8b0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 572 start_va = 0x930000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 573 start_va = 0x704a0000 end_va = 0x7051ffff monitored = 1 entry_point = 0x704a1180 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 574 start_va = 0x77070000 end_va = 0x77101fff monitored = 0 entry_point = 0x770a8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 575 start_va = 0x8c0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 576 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 577 start_va = 0x4680000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 578 start_va = 0x6d6c0000 end_va = 0x6e08bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\1be7a15b1f33bf22e4f53aaf45518c77\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\1be7a15b1f33bf22e4f53aaf45518c77\\system.ni.dll") Region: id = 579 start_va = 0x6cf90000 end_va = 0x6d6b0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\eb4cca4f06a15158c3f7e2c56516729b\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\eb4cca4f06a15158c3f7e2c56516729b\\system.core.ni.dll") Region: id = 580 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 581 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 582 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 583 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 584 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 585 start_va = 0x70380000 end_va = 0x7049cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\98d3949f9ba1a384939805aa5e47e933\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\98d3949f9ba1a384939805aa5e47e933\\system.management.ni.dll") Region: id = 586 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 587 start_va = 0x46f0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046f0000" filename = "" Region: id = 588 start_va = 0x8d0000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 589 start_va = 0x47f0000 end_va = 0x48effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 590 start_va = 0x4680000 end_va = 0x46bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004680000" filename = "" Region: id = 591 start_va = 0x46e0000 end_va = 0x46effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 592 start_va = 0x48f0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 593 start_va = 0x49f0000 end_va = 0x4a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 594 start_va = 0x4a30000 end_va = 0x4b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 595 start_va = 0x70370000 end_va = 0x7037afff monitored = 1 entry_point = 0x703741f0 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 596 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 597 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 598 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 599 start_va = 0xff2d0000 end_va = 0xff31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ff2d0000" filename = "" Region: id = 600 start_va = 0xff2c0000 end_va = 0xff2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ff2c0000" filename = "" Region: id = 601 start_va = 0x910000 end_va = 0x910fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 602 start_va = 0x77110000 end_va = 0x77193fff monitored = 0 entry_point = 0x77136220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 603 start_va = 0x920000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 604 start_va = 0x70350000 end_va = 0x7036bfff monitored = 0 entry_point = 0x7035aa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 605 start_va = 0x702e0000 end_va = 0x70346fff monitored = 0 entry_point = 0x702fb610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 606 start_va = 0x761d0000 end_va = 0x7622efff monitored = 0 entry_point = 0x761d4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 607 start_va = 0x71bb0000 end_va = 0x71bcafff monitored = 0 entry_point = 0x71bb9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 608 start_va = 0x702d0000 end_va = 0x702dcfff monitored = 0 entry_point = 0x702d3520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 998 start_va = 0x702b0000 end_va = 0x702c0fff monitored = 0 entry_point = 0x702b8fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 999 start_va = 0x6ced0000 end_va = 0x6cf8efff monitored = 0 entry_point = 0x6cf01e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1089 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 1096 start_va = 0x4b30000 end_va = 0x4b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 1097 start_va = 0x5140000 end_va = 0x5741fff monitored = 1 entry_point = 0x571ddaa region_type = mapped_file name = "system.servicemodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.servicemodel.dll") Region: id = 1098 start_va = 0x940000 end_va = 0x94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1099 start_va = 0x950000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 1100 start_va = 0x46c0000 end_va = 0x46cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046c0000" filename = "" Region: id = 1101 start_va = 0x46d0000 end_va = 0x46dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046d0000" filename = "" Region: id = 1102 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 1103 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 1104 start_va = 0x70290000 end_va = 0x702adfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "smdiagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\cde471ea4f02c36c73581ed5681e463e\\SMDiagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smdiagnostics\\cde471ea4f02c36c73581ed5681e463e\\smdiagnostics.ni.dll") Region: id = 1105 start_va = 0x71870000 end_va = 0x71882fff monitored = 0 entry_point = 0x71879950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1106 start_va = 0x708a0000 end_va = 0x708cefff monitored = 0 entry_point = 0x708b95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1107 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 1108 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1109 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1110 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1111 start_va = 0x4ca0000 end_va = 0x4da5fff monitored = 1 entry_point = 0x4da09a2 region_type = mapped_file name = "system.identitymodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.IdentityModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.identitymodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.identitymodel.dll") Region: id = 1112 start_va = 0x4b90000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b90000" filename = "" Region: id = 1113 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1114 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1115 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1116 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1117 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1118 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1119 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1120 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1121 start_va = 0x4ba0000 end_va = 0x4bb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ba0000" filename = "" Region: id = 1191 start_va = 0x6cdd0000 end_va = 0x6cec0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\fe4b221b4109f0c78f57a792500699b5\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\fe4b221b4109f0c78f57a792500699b5\\system.configuration.ni.dll") Region: id = 1192 start_va = 0x6c6b0000 end_va = 0x6cdcdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\4fbda26d781323081b45526da6e87b35\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\4fbda26d781323081b45526da6e87b35\\system.xml.ni.dll") Region: id = 1193 start_va = 0x6c600000 end_va = 0x6c6a4fff monitored = 0 entry_point = 0x6c61ac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1194 start_va = 0x70260000 end_va = 0x70282fff monitored = 0 entry_point = 0x70265570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1195 start_va = 0x70250000 end_va = 0x7025ffff monitored = 0 entry_point = 0x70253820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1196 start_va = 0x71a70000 end_va = 0x71abefff monitored = 0 entry_point = 0x71a7d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 1197 start_va = 0x4bc0000 end_va = 0x4c9ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1198 start_va = 0x4db0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1199 start_va = 0x4df0000 end_va = 0x4eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 1200 start_va = 0x71ac0000 end_va = 0x71b5afff monitored = 0 entry_point = 0x71aff7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1201 start_va = 0x71b90000 end_va = 0x71ba1fff monitored = 0 entry_point = 0x71b94510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 1202 start_va = 0x71b60000 end_va = 0x71b8efff monitored = 0 entry_point = 0x71b6bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1203 start_va = 0x76db0000 end_va = 0x76db6fff monitored = 0 entry_point = 0x76db1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1204 start_va = 0x70230000 end_va = 0x70242fff monitored = 0 entry_point = 0x702325d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 1205 start_va = 0x6c5e0000 end_va = 0x6c5f3fff monitored = 0 entry_point = 0x6c5e3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 1206 start_va = 0x4ef0000 end_va = 0x4f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 1207 start_va = 0x4f30000 end_va = 0x502ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 1208 start_va = 0x74bf0000 end_va = 0x75feefff monitored = 0 entry_point = 0x74dab990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1209 start_va = 0x76d70000 end_va = 0x76da6fff monitored = 0 entry_point = 0x76d73b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1210 start_va = 0x76430000 end_va = 0x76928fff monitored = 0 entry_point = 0x76637610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 1211 start_va = 0x76230000 end_va = 0x762bcfff monitored = 0 entry_point = 0x76279b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 1212 start_va = 0x76e70000 end_va = 0x76eb3fff monitored = 0 entry_point = 0x76e77410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 1213 start_va = 0x769c0000 end_va = 0x769cefff monitored = 0 entry_point = 0x769c2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1214 start_va = 0x4b80000 end_va = 0x4b83fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 1215 start_va = 0x5030000 end_va = 0x5030fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005030000" filename = "" Region: id = 1216 start_va = 0x5040000 end_va = 0x5040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1217 start_va = 0x5040000 end_va = 0x5048fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1218 start_va = 0x5040000 end_va = 0x5040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1219 start_va = 0x5040000 end_va = 0x5048fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1220 start_va = 0x5040000 end_va = 0x5040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 1221 start_va = 0x5040000 end_va = 0x5048fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 1222 start_va = 0x710c0000 end_va = 0x71143fff monitored = 0 entry_point = 0x710e6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1223 start_va = 0x71a60000 end_va = 0x71a67fff monitored = 0 entry_point = 0x71a61fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1224 start_va = 0x70840000 end_va = 0x70847fff monitored = 0 entry_point = 0x70841920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1225 start_va = 0x70850000 end_va = 0x70896fff monitored = 0 entry_point = 0x708658d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1226 start_va = 0x76c40000 end_va = 0x76c45fff monitored = 0 entry_point = 0x76c41460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 1227 start_va = 0x6fbd0000 end_va = 0x6fbd9fff monitored = 0 entry_point = 0x6fbd3200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1228 start_va = 0x707d0000 end_va = 0x70833fff monitored = 0 entry_point = 0x707eafd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 1229 start_va = 0x769e0000 end_va = 0x76b57fff monitored = 0 entry_point = 0x76a38a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1230 start_va = 0x769d0000 end_va = 0x769ddfff monitored = 0 entry_point = 0x769d5410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1231 start_va = 0x707c0000 end_va = 0x707cffff monitored = 0 entry_point = 0x707c4600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 1232 start_va = 0x707a0000 end_va = 0x707bffff monitored = 0 entry_point = 0x707ad120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 1233 start_va = 0x70770000 end_va = 0x7079bfff monitored = 0 entry_point = 0x7078bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 1234 start_va = 0x70750000 end_va = 0x70769fff monitored = 0 entry_point = 0x7075fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 1235 start_va = 0x5040000 end_va = 0x507ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 1236 start_va = 0x5750000 end_va = 0x584ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005750000" filename = "" Region: id = 1237 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1238 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1239 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1241 start_va = 0x6c330000 end_va = 0x6c5defff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\9b0d0cb232dec8e57df49678532cb923\\system.runtime.serialization.ni.dll") Region: id = 1242 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1243 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1244 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1245 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1246 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1247 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1248 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1249 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1250 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1251 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1252 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1253 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1254 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1255 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1256 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1257 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1258 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1259 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1260 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1261 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1262 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1263 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1264 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1265 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1266 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1267 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1268 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1269 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1270 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1271 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1272 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1273 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1274 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1275 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1276 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1277 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1278 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1279 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1280 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1281 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1282 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1283 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1284 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1285 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1286 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1287 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1288 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1289 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1290 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1291 start_va = 0x5850000 end_va = 0x594ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005850000" filename = "" Region: id = 1292 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1293 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1294 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1295 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1296 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1297 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1298 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1299 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1300 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1301 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1302 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1303 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1304 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1305 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1306 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1307 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1308 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1309 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1310 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1311 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1312 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1313 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1314 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1315 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1316 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1317 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1318 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1319 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1320 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1321 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1322 start_va = 0x6c260000 end_va = 0x6c322fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.servicemodel.internals.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\System.ServiceModel.Internals.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.servd1dec626#\\1348a5d04b41c614e48fe5fdb88d1cfa\\system.servicemodel.internals.ni.dll") Region: id = 1323 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1324 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1325 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1326 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1327 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1328 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1329 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1330 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1331 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1332 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1333 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1334 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1335 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1336 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1337 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1338 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1339 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1340 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1341 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1342 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1343 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1344 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1345 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1346 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1347 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1348 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1349 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1350 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1351 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1352 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1353 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1354 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1355 start_va = 0x50a0000 end_va = 0x50affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 1356 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1357 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1358 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1359 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1360 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1361 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1362 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1363 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1364 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1365 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1366 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1367 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1368 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1369 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1370 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1372 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1373 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1374 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1375 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1376 start_va = 0x5080000 end_va = 0x508ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1377 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1378 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1379 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1380 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1381 start_va = 0x6c1b0000 end_va = 0x6c25efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\69b67a0435275c1ec53e3bdf64a063b1\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\69b67a0435275c1ec53e3bdf64a063b1\\system.transactions.ni.dll") Region: id = 1382 start_va = 0x6c160000 end_va = 0x6c1aafff monitored = 1 entry_point = 0x6c17f8c2 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1383 start_va = 0x50a0000 end_va = 0x50ebfff monitored = 1 entry_point = 0x50bf8c2 region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1384 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1385 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1386 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1387 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1388 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1389 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1390 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1391 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1392 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1393 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1394 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1395 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1396 start_va = 0x50a0000 end_va = 0x50affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050a0000" filename = "" Region: id = 1397 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1398 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1399 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1400 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1401 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1402 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1403 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1404 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1405 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1406 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1407 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1408 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1409 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1410 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1411 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1412 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1413 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1414 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1415 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1416 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1417 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1418 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1419 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1420 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1421 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1422 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1423 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1424 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1425 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1426 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1427 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1428 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1429 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1430 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1431 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1432 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1433 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1434 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1435 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1436 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1437 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1438 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1439 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1440 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1441 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1442 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1443 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1444 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1445 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1446 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1447 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1448 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1449 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1450 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1451 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1452 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1453 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1454 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1455 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1456 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1457 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1458 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1459 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1460 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1461 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1462 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1463 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1464 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1465 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1466 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1467 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1468 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1469 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1470 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1471 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1472 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1473 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1474 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1475 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1476 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1477 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1478 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1479 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1480 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1481 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1482 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1483 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1484 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1485 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1486 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1487 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1488 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1489 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1490 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1491 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1492 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1493 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1494 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1495 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1496 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1497 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1498 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1499 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1500 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1501 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1502 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1503 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1504 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1505 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1506 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1507 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1508 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1509 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1510 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1511 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1512 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1513 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1514 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1515 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1516 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1517 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1518 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1519 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1520 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1521 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1522 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1523 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1524 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1525 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1526 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1527 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1528 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1529 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1530 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1531 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1532 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1533 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1534 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1535 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1536 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1537 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1538 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1539 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1540 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1541 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1542 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1543 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1544 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1545 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1546 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1547 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1548 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1549 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1550 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1551 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1552 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1553 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1554 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1555 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1556 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1557 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1558 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1559 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1560 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1561 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1562 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1563 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1564 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1565 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1566 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1567 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1568 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1569 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1572 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1573 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1574 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1575 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1576 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1577 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1578 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1579 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1580 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1581 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1582 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1583 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1584 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1585 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1586 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1587 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1588 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1589 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1590 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1591 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1592 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1593 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1594 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1595 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1596 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1597 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1598 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1599 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1600 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1601 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1602 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1603 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1604 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1605 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1606 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1607 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1608 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1609 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1610 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1613 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1614 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1615 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1616 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1617 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1618 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1619 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1620 start_va = 0x50b0000 end_va = 0x50bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 1621 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1622 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1623 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1624 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1625 start_va = 0x5090000 end_va = 0x509ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1626 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1627 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1628 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1629 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1630 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1631 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1632 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1633 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1634 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1635 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1636 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1637 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1638 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1639 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1640 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1641 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1642 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1643 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1644 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1645 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1646 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1647 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1648 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1649 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1650 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1651 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1652 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1653 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1654 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1655 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1656 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1657 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1658 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1659 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1660 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1661 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1662 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1663 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1664 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1665 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1666 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1667 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1668 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1669 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1670 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1671 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1672 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1673 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1674 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1675 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1676 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1677 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1678 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1679 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1680 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1681 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1682 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1683 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1684 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1685 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1686 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1687 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1688 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1689 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1690 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1691 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1692 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1693 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1694 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1695 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1696 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1697 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1698 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1699 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1700 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1701 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1702 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1703 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1704 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1705 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1706 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1707 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1708 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1709 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1710 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1711 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1712 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1713 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1714 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1715 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1716 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1717 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1718 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1719 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1720 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1721 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1722 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1723 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1724 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1725 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1726 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1727 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1728 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1729 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1730 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1731 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1732 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1733 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1734 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1738 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1739 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1740 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1741 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1742 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1743 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1744 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1745 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1746 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1747 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1748 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1749 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1750 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1751 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1752 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1753 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1754 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1755 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1756 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1757 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1758 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1759 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1760 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1761 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1762 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1763 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1764 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1765 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1766 start_va = 0x50c0000 end_va = 0x50cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1767 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1768 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1769 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1770 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1771 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1772 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1773 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1774 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1775 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1776 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1777 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1778 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1779 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1780 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1781 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1782 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1783 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1784 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1785 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1786 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1787 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1788 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1789 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1790 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1791 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1792 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1793 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1794 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1795 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1796 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1797 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1798 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1799 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1800 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1801 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1802 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1803 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1804 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1805 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1806 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1807 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1808 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1809 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1810 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1811 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1812 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1813 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1814 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1815 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1816 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1817 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1818 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1819 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1820 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1821 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1822 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1823 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1824 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1825 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1826 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1827 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1828 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1829 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1830 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1831 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1832 start_va = 0x50d0000 end_va = 0x50dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050d0000" filename = "" Region: id = 1833 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1834 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1835 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1836 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1837 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1838 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1839 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1840 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1841 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1842 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1843 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1844 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1845 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1846 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1847 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1848 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1849 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1850 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1851 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1852 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1853 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1854 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1855 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1856 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1857 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1858 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1859 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1860 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1861 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1862 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1863 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1864 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1865 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1866 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1867 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1868 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1869 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1870 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1871 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1872 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1873 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1874 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1875 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1876 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1877 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1878 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1879 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1880 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1881 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1882 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1883 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1884 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1885 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1886 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1887 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1888 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1889 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1890 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1891 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1892 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1893 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1894 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1895 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1896 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1897 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1898 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1899 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1900 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1901 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1902 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1903 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1904 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1905 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1906 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1907 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1908 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1909 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1910 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1911 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1912 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1913 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1914 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1915 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1916 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1917 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1918 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1922 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1923 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1924 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1925 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1926 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1927 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1928 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1929 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1930 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1931 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1932 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1933 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1934 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1935 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1936 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1937 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1938 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1939 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1940 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1941 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1942 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1943 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1944 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1945 start_va = 0x50e0000 end_va = 0x50effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050e0000" filename = "" Region: id = 1946 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1947 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1948 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1949 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1950 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1951 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1952 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1953 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1954 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1955 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1956 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1957 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1958 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1959 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1960 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1961 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1962 start_va = 0x50f0000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1963 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1964 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1965 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1966 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1967 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1968 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1969 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1970 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1971 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1972 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1973 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1974 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1975 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1976 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1977 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1978 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1979 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1980 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1981 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1982 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1983 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1984 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1985 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1986 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1987 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1988 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1989 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1990 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1991 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 1992 start_va = 0x5120000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 1993 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 1994 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 1995 start_va = 0x5960000 end_va = 0x596ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005960000" filename = "" Region: id = 1996 start_va = 0x5970000 end_va = 0x597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005970000" filename = "" Region: id = 1997 start_va = 0x5980000 end_va = 0x598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005980000" filename = "" Region: id = 1998 start_va = 0x5990000 end_va = 0x599ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005990000" filename = "" Region: id = 1999 start_va = 0x59a0000 end_va = 0x59affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059a0000" filename = "" Region: id = 2000 start_va = 0x59b0000 end_va = 0x59bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059b0000" filename = "" Region: id = 2001 start_va = 0x59c0000 end_va = 0x59cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059c0000" filename = "" Region: id = 2002 start_va = 0x59d0000 end_va = 0x59dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059d0000" filename = "" Region: id = 2003 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2004 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2005 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2006 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2007 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2008 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2009 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2010 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2011 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2012 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2013 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2014 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2015 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2016 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2017 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2018 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2019 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2020 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2021 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2022 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2023 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2024 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2025 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2026 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2027 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2028 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2029 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2030 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2031 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2032 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2033 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2034 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2035 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2036 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2037 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2038 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2039 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2040 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2041 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2042 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2043 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2044 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2045 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2046 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2047 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2048 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2049 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2050 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2051 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2052 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2053 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2054 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2055 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2056 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2057 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2058 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2059 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2060 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2061 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2062 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2063 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2064 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2065 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2066 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2067 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2068 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2069 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2070 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2071 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2072 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2073 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2074 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2075 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2076 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2077 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2078 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2079 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2080 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2081 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2082 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2083 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2084 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2085 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2086 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2087 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2088 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2089 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2090 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2091 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2092 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2093 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2094 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2095 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2096 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2097 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2098 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2099 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2100 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2101 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2102 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2103 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2104 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2105 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2106 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2107 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2108 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2109 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2110 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2111 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2112 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2113 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2114 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2115 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2116 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2117 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2118 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2119 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2120 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2121 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2122 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2123 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2124 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2125 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2126 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2127 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2128 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2129 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2130 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2131 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2132 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2133 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2134 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2135 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2136 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2137 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2138 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2139 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2140 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2141 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2142 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2143 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2144 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2145 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2146 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2147 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2148 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2149 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2150 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2151 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2152 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2153 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2154 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2155 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2156 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2157 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2158 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2159 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2160 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2161 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2162 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2163 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2164 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2165 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2166 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2167 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2168 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2169 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2170 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2171 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2172 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2173 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2174 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2175 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2176 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2177 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2178 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2179 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2180 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2181 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2182 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2183 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2184 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2185 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2186 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2187 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2188 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2189 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2190 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2191 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2192 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2193 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2194 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2195 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2196 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2197 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2198 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2199 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2200 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2201 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2202 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2203 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2204 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2205 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2206 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2207 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2208 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2209 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2210 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2211 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2212 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2213 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2214 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2215 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2216 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2217 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2218 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2219 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2220 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2221 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2222 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2223 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2224 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2225 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2226 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2227 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2228 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2229 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2230 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2231 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2232 start_va = 0x5120000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 2233 start_va = 0x5120000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 2234 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2235 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2236 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2237 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2238 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2239 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2240 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2241 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2242 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2243 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2244 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2245 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2246 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2247 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2248 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2249 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2250 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2251 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2252 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2253 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2254 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2255 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2256 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2257 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2258 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2259 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2260 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2261 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2262 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2263 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2264 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2265 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2266 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2267 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2268 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2269 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2270 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2271 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2272 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2273 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2274 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2275 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2276 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2277 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2278 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2279 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2280 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2281 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2282 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2283 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2284 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2285 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2286 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2287 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2288 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2289 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2290 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2291 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2292 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2293 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2294 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2295 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2296 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2297 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2298 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2299 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2300 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2301 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2302 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2303 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2304 start_va = 0x5110000 end_va = 0x511ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005110000" filename = "" Region: id = 2305 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2306 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2307 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2308 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2309 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2310 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2311 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2312 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2313 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2314 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2315 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2316 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2317 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2318 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2319 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2320 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2321 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2322 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2323 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2324 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2325 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2326 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2327 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2328 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2329 start_va = 0x5120000 end_va = 0x512ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005120000" filename = "" Region: id = 2330 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2331 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2332 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2333 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2334 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2335 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2336 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2337 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2338 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2339 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2340 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2341 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2342 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2343 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2344 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2345 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2346 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2347 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2348 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2349 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2350 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2351 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2352 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2353 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2354 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2355 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2356 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2357 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2358 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2359 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2360 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2361 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2362 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2363 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2364 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2365 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2366 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2367 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2368 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2369 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2370 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2371 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2372 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2373 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2374 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2375 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2376 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2377 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2378 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2379 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2380 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2381 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2382 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2383 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2384 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2385 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2386 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2387 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2388 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2389 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2390 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2391 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2392 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2393 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2394 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2395 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2396 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2397 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2398 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2399 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2400 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2401 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2402 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2403 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2404 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2405 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2406 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2407 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2408 start_va = 0x5130000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 2409 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2410 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2411 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2412 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2413 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2414 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2415 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2416 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2417 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2418 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2419 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2420 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2421 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2422 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2423 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2424 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2425 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2426 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2427 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2428 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2429 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2430 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2431 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2432 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2433 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2434 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2435 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2436 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2437 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2438 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2439 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2440 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2441 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2442 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2443 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2444 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2445 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2446 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2447 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2448 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2449 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2450 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2451 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2452 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2453 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2454 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2455 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2456 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2457 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2458 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2459 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2460 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2461 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2462 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2463 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2464 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2465 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2466 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2467 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2468 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2469 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2470 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2471 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2472 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2473 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2474 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2475 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2476 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2477 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2478 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2479 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2480 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2481 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2482 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2483 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2484 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2485 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2486 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2487 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2488 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2489 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2490 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2491 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2492 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2493 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2494 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2495 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2496 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2497 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2498 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2499 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2500 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2501 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2502 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2503 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2504 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2505 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2506 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2507 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2508 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2509 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2510 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2511 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2512 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2513 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2514 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2515 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2516 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2517 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2518 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2519 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2520 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2521 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2522 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2523 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2524 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2525 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2526 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2527 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2528 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2529 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2530 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2531 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2532 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2533 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2534 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2535 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2536 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2537 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2538 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2539 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2540 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2541 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2542 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2543 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2544 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2545 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2546 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2547 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2548 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2549 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2550 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2551 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2552 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2553 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2554 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2555 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2556 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2557 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2558 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2559 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2560 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2561 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2562 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2563 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2564 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2565 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2566 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2567 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2568 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2569 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2570 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2571 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2572 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2573 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2574 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2575 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2576 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2577 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2578 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2579 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2580 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2581 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2582 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2583 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2584 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2585 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2586 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2587 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2588 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2589 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2590 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2591 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2592 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2593 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2594 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2595 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2596 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2597 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2598 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2599 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2600 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2601 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2602 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2603 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2604 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2605 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2606 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2607 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2608 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2609 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2610 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2611 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2612 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2613 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2614 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2615 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2616 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2617 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2618 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2619 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2620 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2621 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2622 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2623 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2624 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2625 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2626 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2627 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2628 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2629 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2630 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2631 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2632 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2633 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2634 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2635 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2636 start_va = 0x5950000 end_va = 0x595ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2637 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2638 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2639 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2640 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2641 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2642 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2643 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2644 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2645 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2646 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2647 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2648 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2649 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2650 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2651 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2652 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2653 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2654 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2655 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2656 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2657 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2658 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2659 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2660 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2661 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2662 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2663 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2664 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2665 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2666 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2667 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2668 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2669 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2670 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2671 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2672 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2673 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2674 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2675 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2676 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2677 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2678 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2679 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2680 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 2681 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2682 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 2683 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2684 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 2685 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2686 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2687 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2688 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2689 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2690 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2691 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2692 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2693 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2694 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2695 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2696 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2697 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2698 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2699 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2700 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2701 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2702 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2703 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2704 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2705 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2706 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2707 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2708 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2709 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2710 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2711 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2712 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2713 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2714 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2715 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2716 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2717 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2718 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2719 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2720 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2721 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2722 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2723 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2724 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2725 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2726 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2727 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2728 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2729 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2730 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2731 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2732 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2733 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2734 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2735 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2736 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2737 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2738 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2739 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2740 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2741 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2742 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2743 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2744 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2745 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2746 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2747 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2748 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2749 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2750 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2751 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2752 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2753 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2754 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2755 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2756 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2757 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2758 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2759 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2760 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2761 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2762 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2763 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2764 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2765 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2766 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2767 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2768 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2769 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2770 start_va = 0x5bb0000 end_va = 0x5d71fff monitored = 1 entry_point = 0x5d69d32 region_type = mapped_file name = "system.web.extensions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.web.extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\system.web.extensions.dll") Region: id = 2771 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 2772 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2773 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2774 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2775 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2776 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2777 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2778 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2779 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2780 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2781 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2782 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 2783 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2784 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2785 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2786 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2787 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2788 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2789 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2790 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2791 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2792 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2793 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2794 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2795 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2796 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2797 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2798 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2799 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2800 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2801 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2802 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2803 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2804 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2805 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2806 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2807 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2808 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2809 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2810 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2811 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2812 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2813 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2814 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2815 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2816 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2817 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2818 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2819 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2820 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 2821 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2822 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 2823 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2824 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 2825 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2826 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2827 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2828 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2829 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2830 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2831 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2832 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2833 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2834 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2835 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2836 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2837 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2838 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2839 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2840 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2841 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2842 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2843 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2844 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2845 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2854 start_va = 0x6b460000 end_va = 0x6c15bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.web.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Web\\9e5950923286f171d1649a05bdc62830\\System.Web.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.web\\9e5950923286f171d1649a05bdc62830\\system.web.ni.dll") Region: id = 2855 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2856 start_va = 0x6b3d0000 end_va = 0x6b456fff monitored = 1 entry_point = 0x6b3e42f0 region_type = mapped_file name = "webengine4.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\webengine4.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\webengine4.dll") Region: id = 2857 start_va = 0x2a0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2858 start_va = 0x59e0000 end_va = 0x5adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 2859 start_va = 0x6b3b0000 end_va = 0x6b3c8fff monitored = 0 entry_point = 0x6b3b47e0 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 2860 start_va = 0x780000 end_va = 0x796fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "aspnet_rc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\aspnet_rc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\aspnet_rc.dll") Region: id = 2861 start_va = 0x7f0000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 2862 start_va = 0x5950000 end_va = 0x598ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005950000" filename = "" Region: id = 2863 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2864 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2865 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2871 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2872 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2873 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2874 start_va = 0x5990000 end_va = 0x59cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005990000" filename = "" Region: id = 2875 start_va = 0x5d80000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 2876 start_va = 0x74440000 end_va = 0x744b4fff monitored = 0 entry_point = 0x74479a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2877 start_va = 0x5ae0000 end_va = 0x5b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2879 start_va = 0x6b220000 end_va = 0x6b3aefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\1d52bd4ac5e0a6422058a5d62c9f6d9d\\system.drawing.ni.dll") Region: id = 2880 start_va = 0x6a5b0000 end_va = 0x6b216fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\fb06ad4bc55b9c3ca68a3f9259d826cd\\system.windows.forms.ni.dll") Region: id = 2881 start_va = 0x6a560000 end_va = 0x6a5a8fff monitored = 0 entry_point = 0x6a566450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 2882 start_va = 0x5b30000 end_va = 0x5baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 2884 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 2885 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2886 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2887 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2888 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2889 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2892 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 2898 start_va = 0x5990000 end_va = 0x59cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005990000" filename = "" Region: id = 2899 start_va = 0x5ae0000 end_va = 0x5b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2900 start_va = 0x5b20000 end_va = 0x5b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b20000" filename = "" Region: id = 2901 start_va = 0x5d80000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 2902 start_va = 0x5e80000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2907 start_va = 0x6a490000 end_va = 0x6a553fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Security\\754ca70e68140abcdb8476cff64c4169\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.security\\754ca70e68140abcdb8476cff64c4169\\system.security.ni.dll") Region: id = 2908 start_va = 0x6a300000 end_va = 0x6a486fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\849e4f93d41f8b6645878090ee9a7505\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\849e4f93d41f8b6645878090ee9a7505\\microsoft.csharp.ni.dll") Region: id = 2909 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2910 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2911 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2912 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2915 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 2919 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2920 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 2921 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2922 start_va = 0x7a0000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 2923 start_va = 0x6a210000 end_va = 0x6a2f7fff monitored = 1 entry_point = 0x6a247980 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 2924 start_va = 0x6a0a0000 end_va = 0x6a20afff monitored = 0 entry_point = 0x6a10e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 2925 start_va = 0x5e80000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2926 start_va = 0x5ec0000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ec0000" filename = "" Region: id = 2927 start_va = 0x5f80000 end_va = 0x5f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 2928 start_va = 0x5f90000 end_va = 0x608ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f90000" filename = "" Region: id = 2929 start_va = 0x6090000 end_va = 0x6581fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2930 start_va = 0x76c50000 end_va = 0x76d6efff monitored = 0 entry_point = 0x76c95980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2931 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 2932 start_va = 0x6590000 end_va = 0x6a81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006590000" filename = "" Region: id = 2933 start_va = 0x6a90000 end_va = 0x6f81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006a90000" filename = "" Region: id = 2934 start_va = 0x69f20000 end_va = 0x6a092fff monitored = 0 entry_point = 0x69fcd220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 2935 start_va = 0x6f90000 end_va = 0x708ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f90000" filename = "" Region: id = 2936 start_va = 0x7090000 end_va = 0x7136fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007090000" filename = "" Region: id = 2937 start_va = 0x5ae0000 end_va = 0x5b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ae0000" filename = "" Region: id = 2938 start_va = 0x5e80000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 2939 start_va = 0x5f00000 end_va = 0x5f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 2940 start_va = 0x7140000 end_va = 0x723ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007140000" filename = "" Region: id = 2941 start_va = 0x5f40000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f40000" filename = "" Region: id = 2942 start_va = 0x7240000 end_va = 0x733ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007240000" filename = "" Region: id = 2943 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2944 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2945 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2946 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2947 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 2948 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2949 start_va = 0x6090000 end_va = 0x609ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2950 start_va = 0x60a0000 end_va = 0x60affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000060a0000" filename = "" Region: id = 2951 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2952 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 2953 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2954 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2955 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2956 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2957 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 2959 start_va = 0x7c0000 end_va = 0x7c9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 3579 start_va = 0x360000 end_va = 0x362fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 3580 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3583 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3584 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3585 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3586 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3587 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3588 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 3589 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3590 start_va = 0x5100000 end_va = 0x510ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 3591 start_va = 0x5e80000 end_va = 0x5e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 3592 start_va = 0x5e90000 end_va = 0x5e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 3593 start_va = 0x5ea0000 end_va = 0x5eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 3594 start_va = 0x5eb0000 end_va = 0x5ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005eb0000" filename = "" Region: id = 3595 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3596 start_va = 0x69ec0000 end_va = 0x69f1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.dynamic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dynamic\\81f3dddd8aa6172d72bf5f1161e6fd01\\System.Dynamic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dynamic\\81f3dddd8aa6172d72bf5f1161e6fd01\\system.dynamic.ni.dll") Region: id = 3597 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 3598 start_va = 0x5e80000 end_va = 0x5e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 3599 start_va = 0x5e90000 end_va = 0x5e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e90000" filename = "" Region: id = 3600 start_va = 0x5ea0000 end_va = 0x5eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005ea0000" filename = "" Region: id = 3601 start_va = 0x5ea0000 end_va = 0x5ea1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 3602 start_va = 0x6090000 end_va = 0x6159fff monitored = 0 entry_point = 0x60921f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 3603 start_va = 0x5ea0000 end_va = 0x5ea1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 3604 start_va = 0x6090000 end_va = 0x6159fff monitored = 0 entry_point = 0x60921f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 3605 start_va = 0x5ea0000 end_va = 0x5ea4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 3606 start_va = 0x5eb0000 end_va = 0x5ebffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 3607 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3608 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3609 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3610 start_va = 0x5f10000 end_va = 0x5f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f10000" filename = "" Region: id = 3611 start_va = 0x5f20000 end_va = 0x5f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f20000" filename = "" Region: id = 3612 start_va = 0x5f30000 end_va = 0x5f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 3613 start_va = 0x6090000 end_va = 0x609ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 3614 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3615 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3616 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3617 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3618 start_va = 0x5f00000 end_va = 0x5f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3619 start_va = 0x5f00000 end_va = 0x5f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 3620 start_va = 0x6090000 end_va = 0x60cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Thread: id = 12 os_tid = 0x1350 [0207.852] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0207.863] RoInitialize () returned 0x1 [0207.864] RoUninitialize () returned 0x0 [0212.977] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x238) returned 0x0 [0212.979] RegQueryInfoKeyW (in: hKey=0x238, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18ec58, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ec54, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18ec58*=0x42, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ec54*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.983] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x0, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.984] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.984] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.984] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.984] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x4, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.984] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x5, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x6, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x7, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x8, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x9, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xa, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xb, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xc, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.985] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xd, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xe, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0xf, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x10, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x11, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x12, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x13, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.986] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x14, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x15, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x16, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x17, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x18, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x19, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.987] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1a, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1b, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1c, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1d, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0011-0000-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1e, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0015-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x1f, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0016-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.988] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x20, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0018-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.989] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x21, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0019-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.989] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x22, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001A-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.989] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x23, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001B-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.989] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x24, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.989] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x25, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-040C-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x26, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0C0A-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x27, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-002C-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x28, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0044-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x29, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-006E-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2a, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.990] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2b, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2c, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0090-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2d, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00A1-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2e, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00BA-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x2f, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E1-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x30, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E2-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.991] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x31, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0115-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x32, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0117-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x33, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-012B-0409-0000-0000000FF1CE}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x34, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x35, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x36, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x37, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.992] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x38, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x39, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3a, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3b, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3c, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3d, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3e, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x3f, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x40, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.993] RegEnumKeyExW (in: hKey=0x238, dwIndex=0x41, lpName=0x22452c8, lpcchName=0x18ec74, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x18ec74, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0212.994] RegOpenKeyExW (in: hKey=0x238, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0212.995] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0212.995] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.045] RegCloseKey (hKey=0x23c) returned 0x0 [0213.046] RegOpenKeyExW (in: hKey=0x238, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.046] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.046] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.046] RegCloseKey (hKey=0x23c) returned 0x0 [0213.046] RegOpenKeyExW (in: hKey=0x238, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.047] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.047] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.047] RegCloseKey (hKey=0x23c) returned 0x0 [0213.047] RegOpenKeyExW (in: hKey=0x238, lpSubKey="DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.047] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.047] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.047] RegCloseKey (hKey=0x23c) returned 0x0 [0213.048] RegOpenKeyExW (in: hKey=0x238, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.048] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.048] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.048] RegCloseKey (hKey=0x23c) returned 0x0 [0213.048] RegOpenKeyExW (in: hKey=0x238, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.048] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.049] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.049] RegCloseKey (hKey=0x23c) returned 0x0 [0213.049] RegOpenKeyExW (in: hKey=0x238, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.049] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.049] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.049] RegCloseKey (hKey=0x23c) returned 0x0 [0213.049] RegOpenKeyExW (in: hKey=0x238, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.050] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.050] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.050] RegCloseKey (hKey=0x23c) returned 0x0 [0213.050] RegOpenKeyExW (in: hKey=0x238, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.050] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.050] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.050] RegCloseKey (hKey=0x23c) returned 0x0 [0213.050] RegOpenKeyExW (in: hKey=0x238, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.051] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.051] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.051] RegCloseKey (hKey=0x23c) returned 0x0 [0213.051] RegOpenKeyExW (in: hKey=0x238, lpSubKey="MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.051] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.051] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.051] RegCloseKey (hKey=0x23c) returned 0x0 [0213.051] RegOpenKeyExW (in: hKey=0x238, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.052] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.052] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.052] RegCloseKey (hKey=0x23c) returned 0x0 [0213.052] RegOpenKeyExW (in: hKey=0x238, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.052] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.052] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.052] RegCloseKey (hKey=0x23c) returned 0x0 [0213.052] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.052] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7e) returned 0x0 [0213.053] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2247fd4, lpcbData=0x18ec4c*=0x7e | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x18ec4c*=0x7e) returned 0x0 [0213.054] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x18) returned 0x0 [0213.054] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2248140, lpcbData=0x18ec4c*=0x18 | out: lpType=0x18ec50*=0x1, lpData="14.25.28508", lpcbData=0x18ec4c*=0x18) returned 0x0 [0213.297] RegCloseKey (hKey=0x23c) returned 0x0 [0213.297] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.298] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x76) returned 0x0 [0213.298] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x224dc70, lpcbData=0x18ec4c*=0x76 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x18ec4c*=0x76) returned 0x0 [0213.298] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.298] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x224ddcc, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="12.0.21005", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.299] RegCloseKey (hKey=0x23c) returned 0x0 [0213.299] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.300] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.300] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.300] RegCloseKey (hKey=0x23c) returned 0x0 [0213.300] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.300] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.300] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.300] RegCloseKey (hKey=0x23c) returned 0x0 [0213.300] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.301] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.301] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.301] RegCloseKey (hKey=0x23c) returned 0x0 [0213.301] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.301] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.301] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.301] RegCloseKey (hKey=0x23c) returned 0x0 [0213.301] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.302] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.302] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.302] RegCloseKey (hKey=0x23c) returned 0x0 [0213.302] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.302] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.302] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.302] RegCloseKey (hKey=0x23c) returned 0x0 [0213.302] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.302] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.303] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.303] RegCloseKey (hKey=0x23c) returned 0x0 [0213.303] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.303] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x78) returned 0x0 [0213.303] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x224edf0, lpcbData=0x18ec4c*=0x78 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x18ec4c*=0x78) returned 0x0 [0213.303] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x18) returned 0x0 [0213.303] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x224ef4c, lpcbData=0x18ec4c*=0x18 | out: lpType=0x18ec50*=0x1, lpData="14.25.28508", lpcbData=0x18ec4c*=0x18) returned 0x0 [0213.303] RegCloseKey (hKey=0x23c) returned 0x0 [0213.304] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.304] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.304] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x224f2c4, lpcbData=0x18ec4c*=0x7a | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.304] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.304] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x224f428, lpcbData=0x18ec4c*=0x1a | out: lpType=0x18ec50*=0x1, lpData="11.0.61030.0", lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.304] RegCloseKey (hKey=0x23c) returned 0x0 [0213.305] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.305] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.305] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x224f7ac, lpcbData=0x18ec4c*=0x7a | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.305] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.305] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x224f910, lpcbData=0x18ec4c*=0x1a | out: lpType=0x18ec50*=0x1, lpData="12.0.30501.0", lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.305] RegCloseKey (hKey=0x23c) returned 0x0 [0213.305] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.306] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x24) returned 0x0 [0213.306] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x224fcc0, lpcbData=0x18ec4c*=0x24 | out: lpType=0x18ec50*=0x1, lpData="Java Auto Updater", lpcbData=0x18ec4c*=0x24) returned 0x0 [0213.306] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.306] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x224fd74, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="2.8.171.11", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.306] RegCloseKey (hKey=0x23c) returned 0x0 [0213.306] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.307] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x86) returned 0x0 [0213.307] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2250098, lpcbData=0x18ec4c*=0x86 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x18ec4c*=0x86) returned 0x0 [0213.307] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1c) returned 0x0 [0213.307] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2250214, lpcbData=0x18ec4c*=0x1c | out: lpType=0x18ec50*=0x1, lpData="14.25.28508.3", lpcbData=0x18ec4c*=0x1c) returned 0x0 [0213.307] RegCloseKey (hKey=0x23c) returned 0x0 [0213.307] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.307] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x86) returned 0x0 [0213.308] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x22505a8, lpcbData=0x18ec4c*=0x86 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x18ec4c*=0x86) returned 0x0 [0213.308] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1c) returned 0x0 [0213.308] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2250724, lpcbData=0x18ec4c*=0x1c | out: lpType=0x18ec50*=0x1, lpData="14.25.28508.3", lpcbData=0x18ec4c*=0x1c) returned 0x0 [0213.308] RegCloseKey (hKey=0x23c) returned 0x0 [0213.308] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.331] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x54) returned 0x0 [0213.331] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2250ab8, lpcbData=0x18ec4c*=0x54 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x18ec4c*=0x54) returned 0x0 [0213.331] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x14) returned 0x0 [0213.332] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2250bcc, lpcbData=0x18ec4c*=0x14 | out: lpType=0x18ec50*=0x1, lpData="8.0.61001", lpcbData=0x18ec4c*=0x14) returned 0x0 [0213.332] RegCloseKey (hKey=0x23c) returned 0x0 [0213.332] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.332] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.333] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.333] RegCloseKey (hKey=0x23c) returned 0x0 [0213.333] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.333] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.333] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.333] RegCloseKey (hKey=0x23c) returned 0x0 [0213.333] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.334] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.334] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.334] RegCloseKey (hKey=0x23c) returned 0x0 [0213.334] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.334] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.334] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.334] RegCloseKey (hKey=0x23c) returned 0x0 [0213.335] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.335] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.335] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.335] RegCloseKey (hKey=0x23c) returned 0x0 [0213.335] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.335] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.336] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.336] RegCloseKey (hKey=0x23c) returned 0x0 [0213.336] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.336] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.336] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.336] RegCloseKey (hKey=0x23c) returned 0x0 [0213.337] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.337] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.337] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.337] RegCloseKey (hKey=0x23c) returned 0x0 [0213.337] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.337] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.338] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.338] RegCloseKey (hKey=0x23c) returned 0x0 [0213.338] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.338] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.338] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.338] RegCloseKey (hKey=0x23c) returned 0x0 [0213.338] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.340] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.340] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.340] RegCloseKey (hKey=0x23c) returned 0x0 [0213.340] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.341] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.341] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.341] RegCloseKey (hKey=0x23c) returned 0x0 [0213.341] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.341] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.341] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.342] RegCloseKey (hKey=0x23c) returned 0x0 [0213.342] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.342] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.342] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.342] RegCloseKey (hKey=0x23c) returned 0x0 [0213.342] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.343] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.343] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.343] RegCloseKey (hKey=0x23c) returned 0x0 [0213.343] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0090-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.343] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.343] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.343] RegCloseKey (hKey=0x23c) returned 0x0 [0213.344] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.344] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.344] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.344] RegCloseKey (hKey=0x23c) returned 0x0 [0213.344] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.345] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.345] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.345] RegCloseKey (hKey=0x23c) returned 0x0 [0213.345] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-00E1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.345] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.345] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.345] RegCloseKey (hKey=0x23c) returned 0x0 [0213.346] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-00E2-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.346] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.346] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.346] RegCloseKey (hKey=0x23c) returned 0x0 [0213.346] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.346] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.346] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.347] RegCloseKey (hKey=0x23c) returned 0x0 [0213.347] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.347] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.347] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.347] RegCloseKey (hKey=0x23c) returned 0x0 [0213.347] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{90160000-012B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.348] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.348] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.348] RegCloseKey (hKey=0x23c) returned 0x0 [0213.348] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.348] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7e) returned 0x0 [0213.348] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2253744, lpcbData=0x18ec4c*=0x7e | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x18ec4c*=0x7e) returned 0x0 [0213.349] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1e) returned 0x0 [0213.349] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x22538b0, lpcbData=0x18ec4c*=0x1e | out: lpType=0x18ec50*=0x1, lpData="9.0.30729.6161", lpcbData=0x18ec4c*=0x1e) returned 0x0 [0213.349] RegCloseKey (hKey=0x23c) returned 0x0 [0213.349] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.349] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7c) returned 0x0 [0213.349] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2253c44, lpcbData=0x18ec4c*=0x7c | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x18ec4c*=0x7c) returned 0x0 [0213.350] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.350] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2253da8, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="11.0.61030", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.350] RegCloseKey (hKey=0x23c) returned 0x0 [0213.350] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.351] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x76) returned 0x0 [0213.351] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254124, lpcbData=0x18ec4c*=0x76 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x18ec4c*=0x76) returned 0x0 [0213.351] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.351] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254280, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="11.0.61030", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.351] RegCloseKey (hKey=0x23c) returned 0x0 [0213.352] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.352] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.352] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x22545f4, lpcbData=0x18ec4c*=0x7a | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.352] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.352] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254758, lpcbData=0x18ec4c*=0x1a | out: lpType=0x18ec50*=0x1, lpData="11.0.61030.0", lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.353] RegCloseKey (hKey=0x23c) returned 0x0 [0213.353] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.353] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.353] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254adc, lpcbData=0x18ec4c*=0x7a | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x18ec4c*=0x7a) returned 0x0 [0213.353] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.353] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254c40, lpcbData=0x18ec4c*=0x1a | out: lpType=0x18ec50*=0x1, lpData="12.0.30501.0", lpcbData=0x18ec4c*=0x1a) returned 0x0 [0213.354] RegCloseKey (hKey=0x23c) returned 0x0 [0213.354] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.354] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x78) returned 0x0 [0213.354] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2254fc4, lpcbData=0x18ec4c*=0x78 | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x18ec4c*=0x78) returned 0x0 [0213.354] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.355] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x2255120, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="10.0.40219", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.355] RegCloseKey (hKey=0x23c) returned 0x0 [0213.355] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.356] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.356] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.357] RegCloseKey (hKey=0x23c) returned 0x0 [0213.357] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.357] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.357] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.357] RegCloseKey (hKey=0x23c) returned 0x0 [0213.357] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.358] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.358] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.358] RegCloseKey (hKey=0x23c) returned 0x0 [0213.358] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.358] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.358] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.358] RegCloseKey (hKey=0x23c) returned 0x0 [0213.359] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.359] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.359] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.359] RegCloseKey (hKey=0x23c) returned 0x0 [0213.359] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.359] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.360] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.360] RegCloseKey (hKey=0x23c) returned 0x0 [0213.360] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.360] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.360] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x0, lpData=0x0, lpcbData=0x18ec4c*=0x0) returned 0x2 [0213.360] RegCloseKey (hKey=0x23c) returned 0x0 [0213.361] RegOpenKeyExW (in: hKey=0x238, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec30 | out: phkResult=0x18ec30*=0x23c) returned 0x0 [0213.361] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x7c) returned 0x0 [0213.361] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec50, lpData=0x2256148, lpcbData=0x18ec4c*=0x7c | out: lpType=0x18ec50*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x18ec4c*=0x7c) returned 0x0 [0213.361] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x0, lpcbData=0x18ec4c*=0x0 | out: lpType=0x18ec50*=0x1, lpData=0x0, lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.361] RegQueryValueExW (in: hKey=0x23c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec50, lpData=0x22562ac, lpcbData=0x18ec4c*=0x16 | out: lpType=0x18ec50*=0x1, lpData="12.0.21005", lpcbData=0x18ec4c*=0x16) returned 0x0 [0213.362] RegCloseKey (hKey=0x23c) returned 0x0 [0213.362] RegCloseKey (hKey=0x238) returned 0x0 [0214.698] GetCurrentProcessId () returned 0xad0 [0214.708] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x18e55c | out: lpLuid=0x18e55c*(LowPart=0x14, HighPart=0)) returned 1 [0214.716] GetCurrentProcess () returned 0xffffffff [0214.716] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x18e558 | out: TokenHandle=0x18e558*=0x240) returned 1 [0214.719] AdjustTokenPrivileges (in: TokenHandle=0x240, DisableAllPrivileges=0, NewState=0x2256fa4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0214.721] CloseHandle (hObject=0x240) returned 1 [0214.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32454f0, Length=0x20000, ResultLength=0x18ec40 | out: SystemInformation=0x32454f0, ResultLength=0x18ec40*=0x157d8) returned 0x0 [0214.877] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x240 [0214.892] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e4f8 | out: ppv=0x18e4f8*=0x692bc4) returned 0x0 [0215.022] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x18cdc0 | out: phkResult=0x18cdc0*=0x0) returned 0x2 [0215.170] LocalAlloc (uFlags=0x0, uBytes=0x208) returned 0x6b3dd8 [0215.173] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0215.211] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x18dc80, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0215.211] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x70370000 [0215.239] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x18dcb4, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 13 [0215.240] GetProcAddress (hModule=0x70370000, lpProcName="ResetSecurity") returned 0x70372cc0 [0215.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x18dcb4, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0215.289] GetProcAddress (hModule=0x70370000, lpProcName="SetSecurity") returned 0x70372d10 [0215.326] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x18dcb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 18 [0215.326] GetProcAddress (hModule=0x70370000, lpProcName="BlessIWbemServices") returned 0x70372090 [0215.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x18dca8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 24 [0215.396] GetProcAddress (hModule=0x70370000, lpProcName="BlessIWbemServicesObject") returned 0x703720f0 [0215.468] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x18dcb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 17 [0215.468] GetProcAddress (hModule=0x70370000, lpProcName="GetPropertyHandle") returned 0x703727a0 [0215.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x18dcb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 18 [0215.506] GetProcAddress (hModule=0x70370000, lpProcName="WritePropertyValue") returned 0x70372e50 [0215.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x18dcbc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 5 [0215.531] GetProcAddress (hModule=0x70370000, lpProcName="Clone") returned 0x70372150 [0215.554] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x18dcb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0215.554] GetProcAddress (hModule=0x70370000, lpProcName="VerifyClientKey") returned 0x70372e00 [0215.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x18dcb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0215.568] GetProcAddress (hModule=0x70370000, lpProcName="GetQualifierSet") returned 0x70372860 [0215.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x18dcbc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0215.571] GetProcAddress (hModule=0x70370000, lpProcName="Get") returned 0x70372630 [0215.880] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x18dcbc, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0215.881] GetProcAddress (hModule=0x70370000, lpProcName="Put") returned 0x70372970 [0215.957] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x18dcbc, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 6 [0215.957] GetProcAddress (hModule=0x70370000, lpProcName="Delete") returned 0x70372410 [0215.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x18dcb8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 8 [0215.991] GetProcAddress (hModule=0x70370000, lpProcName="GetNames") returned 0x70372740 [0216.089] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x18dcb0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 16 [0216.089] GetProcAddress (hModule=0x70370000, lpProcName="BeginEnumeration") returned 0x70372050 [0216.202] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x18dcbc, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 4 [0216.202] GetProcAddress (hModule=0x70370000, lpProcName="Next") returned 0x70372910 [0216.286] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x18dcb4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 14 [0216.286] GetProcAddress (hModule=0x70370000, lpProcName="EndEnumeration") returned 0x703724d0 [0216.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x18dca8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0216.310] GetProcAddress (hModule=0x70370000, lpProcName="GetPropertyQualifierSet") returned 0x70372830 [0216.372] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x18dcbc, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 5 [0216.373] GetProcAddress (hModule=0x70370000, lpProcName="Clone") returned 0x70372150 [0216.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x18dcb4, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 13 [0216.373] GetProcAddress (hModule=0x70370000, lpProcName="GetObjectText") returned 0x70372770 [0216.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x18dcb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 17 [0216.460] GetProcAddress (hModule=0x70370000, lpProcName="SpawnDerivedClass") returned 0x70372d60 [0216.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x18dcb4, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 13 [0216.482] GetProcAddress (hModule=0x70370000, lpProcName="SpawnInstance") returned 0x70372d90 [0216.485] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x18dcb8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 9 [0216.485] GetProcAddress (hModule=0x70370000, lpProcName="CompareTo") returned 0x70372200 [0216.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x18dcb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 17 [0216.560] GetProcAddress (hModule=0x70370000, lpProcName="GetPropertyOrigin") returned 0x70372800 [0216.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x18dcb4, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 12 [0216.638] GetProcAddress (hModule=0x70370000, lpProcName="InheritsFrom") returned 0x70372880 [0216.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x18dcb8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 9 [0216.640] GetProcAddress (hModule=0x70370000, lpProcName="GetMethod") returned 0x703726b0 [0216.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x18dcb8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 9 [0216.687] GetProcAddress (hModule=0x70370000, lpProcName="PutMethod") returned 0x70372ae0 [0216.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x18dcb4, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 12 [0216.746] GetProcAddress (hModule=0x70370000, lpProcName="DeleteMethod") returned 0x70372430 [0216.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x18dcac, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 22 [0216.749] GetProcAddress (hModule=0x70370000, lpProcName="BeginMethodEnumeration") returned 0x70372070 [0216.754] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x18dcb8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 10 [0216.754] GetProcAddress (hModule=0x70370000, lpProcName="NextMethod") returned 0x70372940 [0216.890] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x18dcac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 20 [0216.891] GetProcAddress (hModule=0x70370000, lpProcName="EndMethodEnumeration") returned 0x703724f0 [0216.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x18dcac, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 21 [0216.895] GetProcAddress (hModule=0x70370000, lpProcName="GetMethodQualifierSet") returned 0x70372710 [0216.898] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x18dcb0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0216.898] GetProcAddress (hModule=0x70370000, lpProcName="GetMethodOrigin") returned 0x703726e0 [0216.900] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x18dcb0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 16 [0216.900] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_Get") returned 0x70372b70 [0216.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x18dcb0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 16 [0216.993] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_Put") returned 0x70372c00 [0217.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x18dcac, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0217.053] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_Delete") returned 0x70372b30 [0217.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x18dcac, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 21 [0217.057] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_GetNames") returned 0x70372ba0 [0217.159] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x18dca4, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 29 [0217.159] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_BeginEnumeration") returned 0x70372b10 [0217.162] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x18dcb0, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 17 [0217.162] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_Next") returned 0x70372bd0 [0217.225] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x18dca4, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0217.225] GetProcAddress (hModule=0x70370000, lpProcName="QualifierSet_EndEnumeration") returned 0x70372b50 [0217.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x18dca8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0217.228] GetProcAddress (hModule=0x70370000, lpProcName="GetCurrentApartmentType") returned 0x70372860 [0217.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x18dcac, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 20 [0217.272] GetProcAddress (hModule=0x70370000, lpProcName="GetDemultiplexedStub") returned 0x70372660 [0217.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x18dcac, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 21 [0217.294] GetProcAddress (hModule=0x70370000, lpProcName="CreateInstanceEnumWmi") returned 0x70372380 [0217.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x18dcb0, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 18 [0217.394] GetProcAddress (hModule=0x70370000, lpProcName="CreateClassEnumWmi") returned 0x703722f0 [0217.398] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x18dcb4, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 12 [0217.398] GetProcAddress (hModule=0x70370000, lpProcName="ExecQueryWmi") returned 0x703725a0 [0217.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x18dca8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 24 [0217.514] GetProcAddress (hModule=0x70370000, lpProcName="ExecNotificationQueryWmi") returned 0x70372510 [0217.517] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x18dcb4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiDp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 14 [0217.517] GetProcAddress (hModule=0x70370000, lpProcName="PutInstanceWmi") returned 0x70372a40 [0217.632] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x18dcb4, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0217.632] GetProcAddress (hModule=0x70370000, lpProcName="PutClassWmi") returned 0x703729a0 [0217.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x18dca8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 24 [0217.635] GetProcAddress (hModule=0x70370000, lpProcName="CloneEnumWbemClassObject") returned 0x70372170 [0217.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x18dcb0, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi´ Dp2÷n\x9c(ú5o\x80ß\x18", lpUsedDefaultChar=0x0) returned 16 [0217.714] GetProcAddress (hModule=0x70370000, lpProcName="ConnectServerWmi") returned 0x70372230 [0217.840] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18e4f0 | out: pAptType=0x18e4f0*=1) returned 0x0 [0217.842] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18e4f4 | out: ppvObject=0x18e4f4*=0x0) returned 0x80004002 [0217.843] IUnknown:Release (This=0x692bc4) returned 0x0 [0217.949] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x18e154 | out: lpiid=0x18e154) returned 0x0 [0217.960] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18de60 | out: ppv=0x18de60*=0x6a3f58) returned 0x0 [0218.231] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e07c | out: ppvObject=0x18e07c*=0x0) returned 0x80004002 [0218.231] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3f58, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e088 | out: ppvObject=0x18e088*=0x6b4bf0) returned 0x0 [0218.233] WbemDefPath:IUnknown:Release (This=0x6a3f58) returned 0x0 [0218.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dcac | out: ppvObject=0x18dcac*=0x6b4bf0) returned 0x0 [0218.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18dc68 | out: ppvObject=0x18dc68*=0x0) returned 0x80004002 [0218.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18d85c | out: ppvObject=0x18d85c*=0x0) returned 0x80004002 [0218.247] WbemDefPath:IUnknown:AddRef (This=0x6b4bf0) returned 0x3 [0218.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18d5bc | out: ppvObject=0x18d5bc*=0x0) returned 0x80004002 [0218.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18d56c | out: ppvObject=0x18d56c*=0x0) returned 0x80004002 [0218.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18d578 | out: ppvObject=0x18d578*=0x6aaec8) returned 0x0 [0218.248] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6aaec8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18d580 | out: pCid=0x18d580*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0218.248] WbemDefPath:IUnknown:Release (This=0x6aaec8) returned 0x3 [0218.249] CoGetContextToken (in: pToken=0x18d5d8 | out: pToken=0x18d5d8) returned 0x0 [0218.275] CoGetContextToken (in: pToken=0x18d9e0 | out: pToken=0x18d9e0) returned 0x0 [0218.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da6c | out: ppvObject=0x18da6c*=0x0) returned 0x80004002 [0218.276] WbemDefPath:IUnknown:Release (This=0x6b4bf0) returned 0x2 [0218.276] WbemDefPath:IUnknown:Release (This=0x6b4bf0) returned 0x1 [0218.276] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0218.276] CoGetContextToken (in: pToken=0x18e2d0 | out: pToken=0x18e2d0) returned 0x0 [0218.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6b4bf0, riid=0x18e3a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e39c | out: ppvObject=0x18e39c*=0x6b4bf0) returned 0x0 [0218.277] WbemDefPath:IUnknown:AddRef (This=0x6b4bf0) returned 0x3 [0218.277] WbemDefPath:IUnknown:Release (This=0x6b4bf0) returned 0x2 [0218.281] WbemDefPath:IWbemPath:SetText (This=0x6b4bf0, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0218.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec28 | out: puCount=0x18ec28*=0x2) returned 0x0 [0218.285] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec24*=0x0, pszText=0x0 | out: puBuffLength=0x18ec24*=0xf, pszText=0x0) returned 0x0 [0218.288] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec24*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec24*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0218.294] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebb0 | out: ppv=0x18ebb0*=0x692bc4) returned 0x0 [0218.294] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eba8 | out: pAptType=0x18eba8*=1) returned 0x0 [0218.294] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebac | out: ppvObject=0x18ebac*=0x0) returned 0x80004002 [0218.294] IUnknown:Release (This=0x692bc4) returned 0x0 [0218.295] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x18eab4 | out: lpiid=0x18eab4) returned 0x0 [0218.297] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e7c0 | out: ppv=0x18e7c0*=0x6ba8e8) returned 0x0 [0218.317] WbemLocator:IUnknown:QueryInterface (in: This=0x6ba8e8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9dc | out: ppvObject=0x18e9dc*=0x0) returned 0x80004002 [0218.317] WbemLocator:IClassFactory:CreateInstance (in: This=0x6ba8e8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9e8 | out: ppvObject=0x18e9e8*=0x6a3f58) returned 0x0 [0218.317] WbemLocator:IUnknown:Release (This=0x6ba8e8) returned 0x0 [0218.317] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e60c | out: ppvObject=0x18e60c*=0x6a3f58) returned 0x0 [0218.317] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5c8 | out: ppvObject=0x18e5c8*=0x0) returned 0x80004002 [0218.317] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1bc | out: ppvObject=0x18e1bc*=0x0) returned 0x80004002 [0218.318] WbemLocator:IUnknown:AddRef (This=0x6a3f58) returned 0x3 [0218.318] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0218.318] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0218.318] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ded8 | out: ppvObject=0x18ded8*=0x0) returned 0x80004002 [0218.318] CoGetContextToken (in: pToken=0x18df38 | out: pToken=0x18df38) returned 0x0 [0218.319] CoGetObjectContext (in: riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x6ba88c | out: ppv=0x6ba88c*=0x692bb8) returned 0x0 [0218.319] CoGetContextToken (in: pToken=0x18e340 | out: pToken=0x18e340) returned 0x0 [0218.320] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3cc | out: ppvObject=0x18e3cc*=0x0) returned 0x80004002 [0218.320] WbemLocator:IUnknown:Release (This=0x6a3f58) returned 0x2 [0218.320] WbemLocator:IUnknown:Release (This=0x6a3f58) returned 0x1 [0218.321] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0218.321] CoGetContextToken (in: pToken=0x18e928 | out: pToken=0x18e928) returned 0x0 [0218.321] WbemLocator:IUnknown:QueryInterface (in: This=0x6a3f58, riid=0x18e9f8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9f4 | out: ppvObject=0x18e9f4*=0x6a3f58) returned 0x0 [0218.321] WbemLocator:IUnknown:AddRef (This=0x6a3f58) returned 0x3 [0218.321] WbemLocator:IUnknown:Release (This=0x6a3f58) returned 0x2 [0218.502] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb8c | out: puCount=0x18eb8c*=0x2) returned 0x0 [0218.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb88*=0x0, pszText=0x0 | out: puBuffLength=0x18eb88*=0xf, pszText=0x0) returned 0x0 [0218.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb88*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb88*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0218.502] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea64 | out: ppv=0x18ea64*=0x6a3ed8) returned 0x0 [0218.503] WbemLocator:IWbemLocator:ConnectServer (in: This=0x6a3ed8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaf8 | out: ppNamespace=0x18eaf8*=0x6a1728) returned 0x0 [0219.434] WbemLocator:IUnknown:QueryInterface (in: This=0x6a1728, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x6bf4cc) returned 0x0 [0219.435] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6bf4cc, pProxy=0x6a1728, pAuthnSvc=0x18e9dc, pAuthzSvc=0x18e9d8, pServerPrincName=0x18e9d0, pAuthnLevel=0x18e9d4, pImpLevel=0x18e9c4, pAuthInfo=0x18e9c8, pCapabilites=0x18e9cc | out: pAuthnSvc=0x18e9dc*=0xa, pAuthzSvc=0x18e9d8*=0x0, pServerPrincName=0x18e9d0, pAuthnLevel=0x18e9d4*=0x6, pImpLevel=0x18e9c4*=0x2, pAuthInfo=0x18e9c8, pCapabilites=0x18e9cc*=0x1) returned 0x0 [0219.435] WbemLocator:IUnknown:Release (This=0x6bf4cc) returned 0x1 [0219.435] WbemLocator:IUnknown:QueryInterface (in: This=0x6a1728, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e980 | out: ppvObject=0x18e980*=0x6bf4f0) returned 0x0 [0219.435] WbemLocator:IUnknown:QueryInterface (in: This=0x6a1728, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e96c | out: ppvObject=0x18e96c*=0x6bf4cc) returned 0x0 [0219.435] WbemLocator:IClientSecurity:SetBlanket (This=0x6bf4cc, pProxy=0x6a1728, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.436] WbemLocator:IUnknown:Release (This=0x6bf4cc) returned 0x2 [0219.436] WbemLocator:IUnknown:Release (This=0x6bf4f0) returned 0x1 [0219.436] CoTaskMemFree (pv=0x6bddd8) [0219.436] WbemLocator:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0219.436] WbemLocator:IUnknown:QueryInterface (in: This=0x6a1728, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e57c | out: ppvObject=0x18e57c*=0x6bf4f0) returned 0x0 [0219.436] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e538 | out: ppvObject=0x18e538*=0x0) returned 0x80004002 [0219.437] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x0) returned 0x80004002 [0219.438] WbemLocator:IUnknown:QueryInterface (in: This=0x6a1728, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0219.439] WbemLocator:IUnknown:AddRef (This=0x6bf4f0) returned 0x3 [0219.439] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de8c | out: ppvObject=0x18de8c*=0x0) returned 0x80004002 [0219.439] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de3c | out: ppvObject=0x18de3c*=0x0) returned 0x80004002 [0219.439] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de48 | out: ppvObject=0x18de48*=0x6bf44c) returned 0x0 [0219.440] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6bf44c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de50 | out: pCid=0x18de50*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.440] WbemLocator:IUnknown:Release (This=0x6bf44c) returned 0x3 [0219.440] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0219.440] CoGetContextToken (in: pToken=0x18e2b0 | out: pToken=0x18e2b0) returned 0x0 [0219.440] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e33c | out: ppvObject=0x18e33c*=0x6bf4d4) returned 0x0 [0219.440] WbemLocator:IRpcOptions:Query (in: This=0x6bf4d4, pPrx=0x6bf4f0, dwProperty=2, pdwValue=0x18e348 | out: pdwValue=0x18e348) returned 0x80004002 [0219.440] WbemLocator:IUnknown:Release (This=0x6bf4d4) returned 0x3 [0219.441] WbemLocator:IUnknown:Release (This=0x6bf4f0) returned 0x2 [0219.441] CoGetContextToken (in: pToken=0x18e890 | out: pToken=0x18e890) returned 0x0 [0219.441] CoGetContextToken (in: pToken=0x18e7f0 | out: pToken=0x18e7f0) returned 0x0 [0219.441] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x18e8c0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e8bc | out: ppvObject=0x18e8bc*=0x6a1728) returned 0x0 [0219.441] WbemLocator:IUnknown:AddRef (This=0x6a1728) returned 0x4 [0219.441] WbemLocator:IUnknown:Release (This=0x6a1728) returned 0x3 [0219.441] WbemLocator:IUnknown:Release (This=0x6a1728) returned 0x2 [0219.467] SysStringLen (param_1=0x0) returned 0x0 [0219.468] CoGetContextToken (in: pToken=0x18e890 | out: pToken=0x18e890) returned 0x0 [0219.468] WbemLocator:IUnknown:AddRef (This=0x6bf4f0) returned 0x3 [0219.469] WbemLocator:IUnknown:QueryInterface (in: This=0x6bf4f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e724 | out: ppvObject=0x18e724*=0x6bf4f0) returned 0x0 [0219.469] WbemLocator:IUnknown:Release (This=0x6bf4f0) returned 0x3 [0219.469] WbemLocator:IUnknown:Release (This=0x6bf4f0) returned 0x2 [0219.470] CoGetContextToken (in: pToken=0x18e968 | out: pToken=0x18e968) returned 0x0 [0219.470] WbemLocator:IUnknown:AddRef (This=0x6a1728) returned 0x3 [0219.470] IWbemServices:ExecQuery (in: This=0x6a1728, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x18eb98 | out: ppEnum=0x18eb98*=0x6bacd0) returned 0x0 [0219.523] IUnknown:QueryInterface (in: This=0x6bacd0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9d0 | out: ppvObject=0x18e9d0*=0x6bacd4) returned 0x0 [0219.523] IClientSecurity:QueryBlanket (in: This=0x6bacd4, pProxy=0x6bacd0, pAuthnSvc=0x18ea20, pAuthzSvc=0x18ea1c, pServerPrincName=0x18ea14, pAuthnLevel=0x18ea18, pImpLevel=0x18ea08, pAuthInfo=0x18ea0c, pCapabilites=0x18ea10 | out: pAuthnSvc=0x18ea20*=0xa, pAuthzSvc=0x18ea1c*=0x0, pServerPrincName=0x18ea14, pAuthnLevel=0x18ea18*=0x6, pImpLevel=0x18ea08*=0x2, pAuthInfo=0x18ea0c, pCapabilites=0x18ea10*=0x1) returned 0x0 [0219.523] IUnknown:Release (This=0x6bacd4) returned 0x1 [0219.523] IUnknown:QueryInterface (in: This=0x6bacd0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9c4 | out: ppvObject=0x18e9c4*=0x6bfa00) returned 0x0 [0219.523] IUnknown:QueryInterface (in: This=0x6bacd0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b0 | out: ppvObject=0x18e9b0*=0x6bacd4) returned 0x0 [0219.523] IClientSecurity:SetBlanket (This=0x6bacd4, pProxy=0x6bacd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.612] IUnknown:Release (This=0x6bacd4) returned 0x2 [0219.613] WbemLocator:IUnknown:Release (This=0x6bfa00) returned 0x1 [0219.613] CoTaskMemFree (pv=0x6be1c8) [0219.613] IUnknown:QueryInterface (in: This=0x6bacd0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x6bfa00) returned 0x0 [0219.613] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0219.614] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e394 | out: ppvObject=0x18e394*=0x0) returned 0x80004002 [0219.615] IUnknown:QueryInterface (in: This=0x6bacd0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0219.616] WbemLocator:IUnknown:AddRef (This=0x6bfa00) returned 0x3 [0219.616] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0219.616] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0219.616] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x6bf95c) returned 0x0 [0219.616] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6bf95c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de90 | out: pCid=0x18de90*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.616] WbemLocator:IUnknown:Release (This=0x6bf95c) returned 0x3 [0219.616] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0219.617] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0219.617] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x6bf9e4) returned 0x0 [0219.617] WbemLocator:IRpcOptions:Query (in: This=0x6bf9e4, pPrx=0x6bfa00, dwProperty=2, pdwValue=0x18e388 | out: pdwValue=0x18e388) returned 0x80004002 [0219.617] WbemLocator:IUnknown:Release (This=0x6bf9e4) returned 0x3 [0219.617] WbemLocator:IUnknown:Release (This=0x6bfa00) returned 0x2 [0219.617] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0219.617] CoGetContextToken (in: pToken=0x18e830 | out: pToken=0x18e830) returned 0x0 [0219.617] WbemLocator:IUnknown:QueryInterface (in: This=0x6bfa00, riid=0x18e900*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8fc | out: ppvObject=0x18e8fc*=0x6bacd0) returned 0x0 [0219.617] IUnknown:AddRef (This=0x6bacd0) returned 0x4 [0219.617] IUnknown:Release (This=0x6bacd0) returned 0x3 [0219.617] IUnknown:Release (This=0x6bacd0) returned 0x2 [0219.617] WbemLocator:IUnknown:Release (This=0x6a1728) returned 0x2 [0219.618] SysStringLen (param_1=0x0) returned 0x0 [0219.618] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0219.618] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0xf, pszText=0x0) returned 0x0 [0219.618] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.618] CoGetContextToken (in: pToken=0x18ea30 | out: pToken=0x18ea30) returned 0x0 [0219.618] IUnknown:AddRef (This=0x6bacd0) returned 0x3 [0219.618] IEnumWbemClassObject:Clone (in: This=0x6bacd0, ppEnum=0x18ebf0 | out: ppEnum=0x18ebf0*=0x6bd0e0) returned 0x0 [0219.622] IUnknown:QueryInterface (in: This=0x6bd0e0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eaac | out: ppvObject=0x18eaac*=0x6bd0e4) returned 0x0 [0219.622] IClientSecurity:QueryBlanket (in: This=0x6bd0e4, pProxy=0x6bd0e0, pAuthnSvc=0x18eafc, pAuthzSvc=0x18eaf8, pServerPrincName=0x18eaf0, pAuthnLevel=0x18eaf4, pImpLevel=0x18eae4, pAuthInfo=0x18eae8, pCapabilites=0x18eaec | out: pAuthnSvc=0x18eafc*=0xa, pAuthzSvc=0x18eaf8*=0x0, pServerPrincName=0x18eaf0, pAuthnLevel=0x18eaf4*=0x6, pImpLevel=0x18eae4*=0x2, pAuthInfo=0x18eae8, pCapabilites=0x18eaec*=0x1) returned 0x0 [0219.623] IUnknown:Release (This=0x6bd0e4) returned 0x1 [0219.623] IUnknown:QueryInterface (in: This=0x6bd0e0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eaa0 | out: ppvObject=0x18eaa0*=0x6c1968) returned 0x0 [0219.623] IUnknown:QueryInterface (in: This=0x6bd0e0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea8c | out: ppvObject=0x18ea8c*=0x6bd0e4) returned 0x0 [0219.623] IClientSecurity:SetBlanket (This=0x6bd0e4, pProxy=0x6bd0e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.626] IUnknown:Release (This=0x6bd0e4) returned 0x2 [0219.626] WbemLocator:IUnknown:Release (This=0x6c1968) returned 0x1 [0219.626] CoTaskMemFree (pv=0x6be288) [0219.627] IUnknown:QueryInterface (in: This=0x6bd0e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e688 | out: ppvObject=0x18e688*=0x6c1968) returned 0x0 [0219.627] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e644 | out: ppvObject=0x18e644*=0x0) returned 0x80004002 [0219.628] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e464 | out: ppvObject=0x18e464*=0x0) returned 0x80004002 [0219.725] IUnknown:QueryInterface (in: This=0x6bd0e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e23c | out: ppvObject=0x18e23c*=0x0) returned 0x80004002 [0219.726] WbemLocator:IUnknown:AddRef (This=0x6c1968) returned 0x3 [0219.726] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df9c | out: ppvObject=0x18df9c*=0x0) returned 0x80004002 [0219.726] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0219.726] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df58 | out: ppvObject=0x18df58*=0x6c18c4) returned 0x0 [0219.727] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c18c4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df60 | out: pCid=0x18df60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.727] WbemLocator:IUnknown:Release (This=0x6c18c4) returned 0x3 [0219.727] CoGetContextToken (in: pToken=0x18dfb8 | out: pToken=0x18dfb8) returned 0x0 [0219.727] CoGetContextToken (in: pToken=0x18e3c0 | out: pToken=0x18e3c0) returned 0x0 [0219.727] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e44c | out: ppvObject=0x18e44c*=0x6c194c) returned 0x0 [0219.727] WbemLocator:IRpcOptions:Query (in: This=0x6c194c, pPrx=0x6c1968, dwProperty=2, pdwValue=0x18e458 | out: pdwValue=0x18e458) returned 0x80004002 [0219.727] WbemLocator:IUnknown:Release (This=0x6c194c) returned 0x3 [0219.727] WbemLocator:IUnknown:Release (This=0x6c1968) returned 0x2 [0219.727] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0219.727] CoGetContextToken (in: pToken=0x18e8f8 | out: pToken=0x18e8f8) returned 0x0 [0219.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1968, riid=0x18e9c8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e9c4 | out: ppvObject=0x18e9c4*=0x6bd0e0) returned 0x0 [0219.728] IUnknown:AddRef (This=0x6bd0e0) returned 0x4 [0219.728] IUnknown:Release (This=0x6bd0e0) returned 0x3 [0219.728] IUnknown:Release (This=0x6bd0e0) returned 0x2 [0219.728] IUnknown:Release (This=0x6bacd0) returned 0x2 [0219.728] SysStringLen (param_1=0x0) returned 0x0 [0219.730] IEnumWbemClassObject:Reset (This=0x6bd0e0) returned 0x0 [0219.839] CoTaskMemAlloc (cb=0x4) returned 0x6a3e98 [0219.840] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3e98, puReturned=0x227e9dc | out: apObjects=0x6a3e98*=0x6c8338, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.660] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6c8338) returned 0x0 [0222.661] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.661] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.661] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.662] IUnknown:AddRef (This=0x6c8338) returned 0x3 [0222.662] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.662] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.662] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6c833c) returned 0x0 [0222.662] IMarshal:GetUnmarshalClass (in: This=0x6c833c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.663] IUnknown:Release (This=0x6c833c) returned 0x3 [0222.663] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.663] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.663] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.663] IUnknown:Release (This=0x6c8338) returned 0x2 [0222.663] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.663] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.663] IUnknown:QueryInterface (in: This=0x6c8338, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6c8338) returned 0x0 [0222.664] IUnknown:AddRef (This=0x6c8338) returned 0x4 [0222.664] IUnknown:Release (This=0x6c8338) returned 0x3 [0222.665] IUnknown:Release (This=0x6c8338) returned 0x2 [0222.667] CoTaskMemFree (pv=0x6a3e98) [0222.667] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.667] IUnknown:AddRef (This=0x6c8338) returned 0x3 [0222.673] IWbemClassObject:Get (in: This=0x6c8338, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.677] IWbemClassObject:Get (in: This=0x6c8338, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.681] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0222.681] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0222.682] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.683] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.683] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.683] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.687] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ff8) returned 0x0 [0222.688] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ff8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.688] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ff8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ccce0) returned 0x0 [0222.689] WbemDefPath:IUnknown:Release (This=0x6a3ff8) returned 0x0 [0222.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ccce0) returned 0x0 [0222.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.690] WbemDefPath:IUnknown:AddRef (This=0x6ccce0) returned 0x3 [0222.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ba9d8) returned 0x0 [0222.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ba9d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.690] WbemDefPath:IUnknown:Release (This=0x6ba9d8) returned 0x3 [0222.690] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.690] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.691] WbemDefPath:IUnknown:Release (This=0x6ccce0) returned 0x2 [0222.691] WbemDefPath:IUnknown:Release (This=0x6ccce0) returned 0x1 [0222.691] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.691] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ccce0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ccce0) returned 0x0 [0222.691] WbemDefPath:IUnknown:AddRef (This=0x6ccce0) returned 0x3 [0222.691] WbemDefPath:IUnknown:Release (This=0x6ccce0) returned 0x2 [0222.691] WbemDefPath:IWbemPath:SetText (This=0x6ccce0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x0 [0222.692] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.692] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.692] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.792] IWbemClassObject:Get (in: This=0x6c8338, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f304*=0, plFlavor=0x227f308*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c4, varVal2=0x0), pType=0x227f304*=19, plFlavor=0x227f308*=0) returned 0x0 [0222.792] IWbemClassObject:Get (in: This=0x6c8338, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f304*=19, plFlavor=0x227f308*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c4, varVal2=0x0), pType=0x227f304*=19, plFlavor=0x227f308*=0) returned 0x0 [0222.806] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.806] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.806] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.806] IWbemClassObject:Get (in: This=0x6c8338, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f658*=0, plFlavor=0x227f65c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x227f658*=8, plFlavor=0x227f65c*=0) returned 0x0 [0222.806] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0222.806] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0222.806] IWbemClassObject:Get (in: This=0x6c8338, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f658*=8, plFlavor=0x227f65c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x227f658*=8, plFlavor=0x227f65c*=0) returned 0x0 [0222.806] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0222.806] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0222.810] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.810] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.810] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.810] IWbemClassObject:Get (in: This=0x6c8338, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f78c*=0, plFlavor=0x227f790*=0 | out: pVal=0x18ebe4*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f78c*=8, plFlavor=0x227f790*=32) returned 0x0 [0222.815] IWbemClassObject:Get (in: This=0x6c8338, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f78c*=8, plFlavor=0x227f790*=32 | out: pVal=0x18ebec*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x227f78c*=8, plFlavor=0x227f790*=32) returned 0x0 [0222.816] CoTaskMemAlloc (cb=0x4) returned 0x6a4008 [0222.816] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a4008, puReturned=0x227e9dc | out: apObjects=0x6a4008*=0x6cd470, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.819] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6cd470) returned 0x0 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.820] IUnknown:AddRef (This=0x6cd470) returned 0x3 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.820] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6cd474) returned 0x0 [0222.821] IMarshal:GetUnmarshalClass (in: This=0x6cd474, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.821] IUnknown:Release (This=0x6cd474) returned 0x3 [0222.821] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.821] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.821] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.821] IUnknown:Release (This=0x6cd470) returned 0x2 [0222.822] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.822] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.822] IUnknown:QueryInterface (in: This=0x6cd470, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6cd470) returned 0x0 [0222.822] IUnknown:AddRef (This=0x6cd470) returned 0x4 [0222.822] IUnknown:Release (This=0x6cd470) returned 0x3 [0222.822] IUnknown:Release (This=0x6cd470) returned 0x2 [0222.822] CoTaskMemFree (pv=0x6a4008) [0222.822] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.822] IUnknown:AddRef (This=0x6cd470) returned 0x3 [0222.822] IWbemClassObject:Get (in: This=0x6cd470, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.822] IWbemClassObject:Get (in: This=0x6cd470, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.823] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0222.823] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0222.823] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.823] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.823] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.823] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.825] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0222.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cd158) returned 0x0 [0222.826] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0222.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cd158) returned 0x0 [0222.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.826] WbemDefPath:IUnknown:AddRef (This=0x6cd158) returned 0x3 [0222.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6cd110) returned 0x0 [0222.827] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6cd110, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.827] WbemDefPath:IUnknown:Release (This=0x6cd110) returned 0x3 [0222.827] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.827] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.827] WbemDefPath:IUnknown:Release (This=0x6cd158) returned 0x2 [0222.827] WbemDefPath:IUnknown:Release (This=0x6cd158) returned 0x1 [0222.828] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.828] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.828] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd158, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cd158) returned 0x0 [0222.828] WbemDefPath:IUnknown:AddRef (This=0x6cd158) returned 0x3 [0222.828] WbemDefPath:IUnknown:Release (This=0x6cd158) returned 0x2 [0222.828] WbemDefPath:IWbemPath:SetText (This=0x6cd158, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x0 [0222.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.828] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.828] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.829] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.829] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.829] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.829] IWbemClassObject:Get (in: This=0x6cd470, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22800a8*=0, plFlavor=0x22800ac*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f8, varVal2=0x0), pType=0x22800a8*=19, plFlavor=0x22800ac*=0) returned 0x0 [0222.829] IWbemClassObject:Get (in: This=0x6cd470, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22800a8*=19, plFlavor=0x22800ac*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f8, varVal2=0x0), pType=0x22800a8*=19, plFlavor=0x22800ac*=0) returned 0x0 [0222.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.830] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.830] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.830] IWbemClassObject:Get (in: This=0x6cd470, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22801a8*=0, plFlavor=0x22801ac*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x22801a8*=8, plFlavor=0x22801ac*=0) returned 0x0 [0222.830] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.830] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.830] IWbemClassObject:Get (in: This=0x6cd470, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22801a8*=8, plFlavor=0x22801ac*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x22801a8*=8, plFlavor=0x22801ac*=0) returned 0x0 [0222.831] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.831] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.831] IWbemClassObject:Get (in: This=0x6cd470, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22802ec*=0, plFlavor=0x22802f0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x22802ec*=8, plFlavor=0x22802f0*=0) returned 0x0 [0222.831] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.831] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.831] IWbemClassObject:Get (in: This=0x6cd470, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22802ec*=8, plFlavor=0x22802f0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x22802ec*=8, plFlavor=0x22802f0*=0) returned 0x0 [0222.832] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.832] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0222.832] CoTaskMemAlloc (cb=0x4) returned 0x6a3e98 [0222.832] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3e98, puReturned=0x227e9dc | out: apObjects=0x6a3e98*=0x6cd1c8, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.867] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6cd1c8) returned 0x0 [0222.868] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.868] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.868] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.868] IUnknown:AddRef (This=0x6cd1c8) returned 0x3 [0222.868] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.868] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.869] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6cd1cc) returned 0x0 [0222.869] IMarshal:GetUnmarshalClass (in: This=0x6cd1cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.869] IUnknown:Release (This=0x6cd1cc) returned 0x3 [0222.869] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.869] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.869] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.869] IUnknown:Release (This=0x6cd1c8) returned 0x2 [0222.869] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.869] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.870] IUnknown:QueryInterface (in: This=0x6cd1c8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6cd1c8) returned 0x0 [0222.870] IUnknown:AddRef (This=0x6cd1c8) returned 0x4 [0222.870] IUnknown:Release (This=0x6cd1c8) returned 0x3 [0222.870] IUnknown:Release (This=0x6cd1c8) returned 0x2 [0222.870] CoTaskMemFree (pv=0x6a3e98) [0222.870] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.870] IUnknown:AddRef (This=0x6cd1c8) returned 0x3 [0222.870] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.870] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.871] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0222.871] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0222.871] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.871] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.871] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.871] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.873] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3e98) returned 0x0 [0222.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3e98, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.873] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3e98, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cd360) returned 0x0 [0222.873] WbemDefPath:IUnknown:Release (This=0x6a3e98) returned 0x0 [0222.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cd360) returned 0x0 [0222.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.874] WbemDefPath:IUnknown:AddRef (This=0x6cd360) returned 0x3 [0222.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ccfd8) returned 0x0 [0222.874] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ccfd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.874] WbemDefPath:IUnknown:Release (This=0x6ccfd8) returned 0x3 [0222.874] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.874] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.875] WbemDefPath:IUnknown:Release (This=0x6cd360) returned 0x2 [0222.875] WbemDefPath:IUnknown:Release (This=0x6cd360) returned 0x1 [0222.875] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.875] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.875] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd360, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cd360) returned 0x0 [0222.875] WbemDefPath:IUnknown:AddRef (This=0x6cd360) returned 0x3 [0222.875] WbemDefPath:IUnknown:Release (This=0x6cd360) returned 0x2 [0222.875] WbemDefPath:IWbemPath:SetText (This=0x6cd360, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x0 [0222.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.875] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.875] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.875] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.875] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.876] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.876] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280c5c*=0, plFlavor=0x2280c60*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f4, varVal2=0x0), pType=0x2280c5c*=19, plFlavor=0x2280c60*=0) returned 0x0 [0222.876] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280c5c*=19, plFlavor=0x2280c60*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f4, varVal2=0x0), pType=0x2280c5c*=19, plFlavor=0x2280c60*=0) returned 0x0 [0222.876] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.876] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.876] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.877] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280d5c*=0, plFlavor=0x2280d60*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2280d5c*=8, plFlavor=0x2280d60*=0) returned 0x0 [0222.877] SysStringByteLen (bstr="dwm.exe") returned 0xe [0222.877] SysStringByteLen (bstr="dwm.exe") returned 0xe [0222.877] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280d5c*=8, plFlavor=0x2280d60*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2280d5c*=8, plFlavor=0x2280d60*=0) returned 0x0 [0222.877] SysStringByteLen (bstr="dwm.exe") returned 0xe [0222.877] SysStringByteLen (bstr="dwm.exe") returned 0xe [0222.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.878] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.878] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.878] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280e88*=0, plFlavor=0x2280e8c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x2280e88*=8, plFlavor=0x2280e8c*=0) returned 0x0 [0222.878] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0222.878] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0222.878] IWbemClassObject:Get (in: This=0x6cd1c8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2280e88*=8, plFlavor=0x2280e8c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x2280e88*=8, plFlavor=0x2280e8c*=0) returned 0x0 [0222.878] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0222.878] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0222.879] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0222.879] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6cde90, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.881] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6cde90) returned 0x0 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.882] IUnknown:AddRef (This=0x6cde90) returned 0x3 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.882] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6cde94) returned 0x0 [0222.883] IMarshal:GetUnmarshalClass (in: This=0x6cde94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.883] IUnknown:Release (This=0x6cde94) returned 0x3 [0222.883] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.883] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.883] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.883] IUnknown:Release (This=0x6cde90) returned 0x2 [0222.883] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.884] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.884] IUnknown:QueryInterface (in: This=0x6cde90, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6cde90) returned 0x0 [0222.884] IUnknown:AddRef (This=0x6cde90) returned 0x4 [0222.884] IUnknown:Release (This=0x6cde90) returned 0x3 [0222.884] IUnknown:Release (This=0x6cde90) returned 0x2 [0222.884] CoTaskMemFree (pv=0x6a3ea8) [0222.884] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.884] IUnknown:AddRef (This=0x6cde90) returned 0x3 [0222.884] IWbemClassObject:Get (in: This=0x6cde90, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.885] IWbemClassObject:Get (in: This=0x6cde90, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0222.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0222.885] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.885] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.885] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.885] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.887] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0222.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cd3d0) returned 0x0 [0222.887] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0222.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cd3d0) returned 0x0 [0222.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.888] WbemDefPath:IUnknown:AddRef (This=0x6cd3d0) returned 0x3 [0222.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6cce88) returned 0x0 [0222.888] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6cce88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.888] WbemDefPath:IUnknown:Release (This=0x6cce88) returned 0x3 [0222.889] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.889] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.889] WbemDefPath:IUnknown:Release (This=0x6cd3d0) returned 0x2 [0222.889] WbemDefPath:IUnknown:Release (This=0x6cd3d0) returned 0x1 [0222.889] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.889] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cd3d0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cd3d0) returned 0x0 [0222.889] WbemDefPath:IUnknown:AddRef (This=0x6cd3d0) returned 0x3 [0222.890] WbemDefPath:IUnknown:Release (This=0x6cd3d0) returned 0x2 [0222.890] WbemDefPath:IWbemPath:SetText (This=0x6cd3d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.890] IWbemClassObject:Get (in: This=0x6cde90, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22817d8*=0, plFlavor=0x22817dc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x59c, varVal2=0x0), pType=0x22817d8*=19, plFlavor=0x22817dc*=0) returned 0x0 [0222.890] IWbemClassObject:Get (in: This=0x6cde90, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22817d8*=19, plFlavor=0x22817dc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x59c, varVal2=0x0), pType=0x22817d8*=19, plFlavor=0x22817dc*=0) returned 0x0 [0222.891] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.891] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.891] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.891] IWbemClassObject:Get (in: This=0x6cde90, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22818dc*=0, plFlavor=0x22818e0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x22818dc*=8, plFlavor=0x22818e0*=0) returned 0x0 [0222.891] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.891] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.891] IWbemClassObject:Get (in: This=0x6cde90, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22818dc*=8, plFlavor=0x22818e0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x22818dc*=8, plFlavor=0x22818e0*=0) returned 0x0 [0222.891] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.891] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.892] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.892] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.892] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.892] IWbemClassObject:Get (in: This=0x6cde90, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2281a18*=0, plFlavor=0x2281a1c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2281a18*=8, plFlavor=0x2281a1c*=0) returned 0x0 [0222.892] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.892] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.892] IWbemClassObject:Get (in: This=0x6cde90, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2281a18*=8, plFlavor=0x2281a1c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x2281a18*=8, plFlavor=0x2281a1c*=0) returned 0x0 [0222.893] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.893] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0222.893] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0222.893] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6cd8c8, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.895] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6cd8c8) returned 0x0 [0222.895] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.895] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.895] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.896] IUnknown:AddRef (This=0x6cd8c8) returned 0x3 [0222.896] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.896] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.897] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6cd8cc) returned 0x0 [0222.897] IMarshal:GetUnmarshalClass (in: This=0x6cd8cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.897] IUnknown:Release (This=0x6cd8cc) returned 0x3 [0222.897] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.897] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.897] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.897] IUnknown:Release (This=0x6cd8c8) returned 0x2 [0222.897] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.897] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.898] IUnknown:QueryInterface (in: This=0x6cd8c8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6cd8c8) returned 0x0 [0222.898] IUnknown:AddRef (This=0x6cd8c8) returned 0x4 [0222.898] IUnknown:Release (This=0x6cd8c8) returned 0x3 [0222.898] IUnknown:Release (This=0x6cd8c8) returned 0x2 [0222.898] CoTaskMemFree (pv=0x6a3ea8) [0222.898] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.898] IUnknown:AddRef (This=0x6cd8c8) returned 0x3 [0222.898] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.898] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0222.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0222.899] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.899] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.899] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.899] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.902] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0222.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.902] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cda60) returned 0x0 [0222.903] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0222.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cda60) returned 0x0 [0222.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.903] WbemDefPath:IUnknown:AddRef (This=0x6cda60) returned 0x3 [0222.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ce4e8) returned 0x0 [0222.904] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ce4e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.904] WbemDefPath:IUnknown:Release (This=0x6ce4e8) returned 0x3 [0222.904] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.904] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.904] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.904] WbemDefPath:IUnknown:Release (This=0x6cda60) returned 0x2 [0222.904] WbemDefPath:IUnknown:Release (This=0x6cda60) returned 0x1 [0222.905] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.905] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cda60, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cda60) returned 0x0 [0222.905] WbemDefPath:IUnknown:AddRef (This=0x6cda60) returned 0x3 [0222.905] WbemDefPath:IUnknown:Release (This=0x6cda60) returned 0x2 [0222.905] WbemDefPath:IWbemPath:SetText (This=0x6cda60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.906] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2282378*=0, plFlavor=0x228237c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x2282378*=19, plFlavor=0x228237c*=0) returned 0x0 [0222.906] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2282378*=19, plFlavor=0x228237c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x2282378*=19, plFlavor=0x228237c*=0) returned 0x0 [0222.906] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.906] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.906] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.906] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228247c*=0, plFlavor=0x2282480*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x228247c*=8, plFlavor=0x2282480*=0) returned 0x0 [0222.907] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0222.907] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0222.907] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228247c*=8, plFlavor=0x2282480*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x228247c*=8, plFlavor=0x2282480*=0) returned 0x0 [0222.907] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0222.907] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0222.907] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.907] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.907] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.908] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22825d0*=0, plFlavor=0x22825d4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x22825d0*=8, plFlavor=0x22825d4*=0) returned 0x0 [0222.908] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0222.908] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0222.908] IWbemClassObject:Get (in: This=0x6cd8c8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22825d0*=8, plFlavor=0x22825d4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x22825d0*=8, plFlavor=0x22825d4*=0) returned 0x0 [0222.908] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0222.908] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0222.908] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0222.909] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6ce6e0, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6ce6e0) returned 0x0 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.960] IUnknown:AddRef (This=0x6ce6e0) returned 0x3 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.960] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6ce6e4) returned 0x0 [0222.961] IMarshal:GetUnmarshalClass (in: This=0x6ce6e4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.961] IUnknown:Release (This=0x6ce6e4) returned 0x3 [0222.961] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.961] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.961] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.961] IUnknown:Release (This=0x6ce6e0) returned 0x2 [0222.961] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.961] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.961] IUnknown:QueryInterface (in: This=0x6ce6e0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6ce6e0) returned 0x0 [0222.961] IUnknown:AddRef (This=0x6ce6e0) returned 0x4 [0222.961] IUnknown:Release (This=0x6ce6e0) returned 0x3 [0222.961] IUnknown:Release (This=0x6ce6e0) returned 0x2 [0222.961] CoTaskMemFree (pv=0x6a3ea8) [0222.961] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.961] IUnknown:AddRef (This=0x6ce6e0) returned 0x3 [0222.962] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.962] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0222.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0222.962] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.962] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.962] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.963] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.964] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.964] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cdad0) returned 0x0 [0222.964] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cdad0) returned 0x0 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.964] WbemDefPath:IUnknown:AddRef (This=0x6cdad0) returned 0x3 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ce470) returned 0x0 [0222.964] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ce470, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.964] WbemDefPath:IUnknown:Release (This=0x6ce470) returned 0x3 [0222.965] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.965] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.965] WbemDefPath:IUnknown:Release (This=0x6cdad0) returned 0x2 [0222.965] WbemDefPath:IUnknown:Release (This=0x6cdad0) returned 0x1 [0222.965] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.965] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdad0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cdad0) returned 0x0 [0222.965] WbemDefPath:IUnknown:AddRef (This=0x6cdad0) returned 0x3 [0222.965] WbemDefPath:IUnknown:Release (This=0x6cdad0) returned 0x2 [0222.965] WbemDefPath:IWbemPath:SetText (This=0x6cdad0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x0 [0222.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.965] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.965] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.965] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.966] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283050*=0, plFlavor=0x2283054*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5d8, varVal2=0x0), pType=0x2283050*=19, plFlavor=0x2283054*=0) returned 0x0 [0222.966] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283050*=19, plFlavor=0x2283054*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5d8, varVal2=0x0), pType=0x2283050*=19, plFlavor=0x2283054*=0) returned 0x0 [0222.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.966] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283154*=0, plFlavor=0x2283158*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x2283154*=8, plFlavor=0x2283158*=0) returned 0x0 [0222.966] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0222.966] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0222.967] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283154*=8, plFlavor=0x2283158*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x2283154*=8, plFlavor=0x2283158*=0) returned 0x0 [0222.967] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0222.967] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0222.967] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.967] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283298*=0, plFlavor=0x228329c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x2283298*=8, plFlavor=0x228329c*=0) returned 0x0 [0222.967] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0222.967] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0222.968] IWbemClassObject:Get (in: This=0x6ce6e0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283298*=8, plFlavor=0x228329c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x2283298*=8, plFlavor=0x228329c*=0) returned 0x0 [0222.968] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0222.968] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0222.968] CoTaskMemAlloc (cb=0x4) returned 0x6a3ed8 [0222.968] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ed8, puReturned=0x227e9dc | out: apObjects=0x6a3ed8*=0x67e6f8, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.970] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x67e6f8) returned 0x0 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.971] IUnknown:AddRef (This=0x67e6f8) returned 0x3 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.971] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x67e6fc) returned 0x0 [0222.971] IMarshal:GetUnmarshalClass (in: This=0x67e6fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.972] IUnknown:Release (This=0x67e6fc) returned 0x3 [0222.972] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.972] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.972] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.972] IUnknown:Release (This=0x67e6f8) returned 0x2 [0222.972] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.972] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.972] IUnknown:QueryInterface (in: This=0x67e6f8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x67e6f8) returned 0x0 [0222.972] IUnknown:AddRef (This=0x67e6f8) returned 0x4 [0222.973] IUnknown:Release (This=0x67e6f8) returned 0x3 [0222.973] IUnknown:Release (This=0x67e6f8) returned 0x2 [0222.973] CoTaskMemFree (pv=0x6a3ed8) [0222.973] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.973] IUnknown:AddRef (This=0x67e6f8) returned 0x3 [0222.973] IWbemClassObject:Get (in: This=0x67e6f8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.973] IWbemClassObject:Get (in: This=0x67e6f8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.973] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0222.973] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0222.973] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.974] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.974] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.974] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.983] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0222.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.984] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6cdb40) returned 0x0 [0222.984] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0222.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6cdb40) returned 0x0 [0222.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.984] WbemDefPath:IUnknown:AddRef (This=0x6cdb40) returned 0x3 [0222.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6c8ec0) returned 0x0 [0222.985] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6c8ec0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.985] WbemDefPath:IUnknown:Release (This=0x6c8ec0) returned 0x3 [0222.985] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.985] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.985] WbemDefPath:IUnknown:Release (This=0x6cdb40) returned 0x2 [0222.985] WbemDefPath:IUnknown:Release (This=0x6cdb40) returned 0x1 [0222.985] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.986] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6cdb40, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6cdb40) returned 0x0 [0222.986] WbemDefPath:IUnknown:AddRef (This=0x6cdb40) returned 0x3 [0222.986] WbemDefPath:IUnknown:Release (This=0x6cdb40) returned 0x2 [0222.986] WbemDefPath:IWbemPath:SetText (This=0x6cdb40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.986] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.986] IWbemClassObject:Get (in: This=0x67e6f8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283cfc*=0, plFlavor=0x2283d00*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x560, varVal2=0x0), pType=0x2283cfc*=19, plFlavor=0x2283d00*=0) returned 0x0 [0222.987] IWbemClassObject:Get (in: This=0x67e6f8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283cfc*=19, plFlavor=0x2283d00*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x560, varVal2=0x0), pType=0x2283cfc*=19, plFlavor=0x2283d00*=0) returned 0x0 [0222.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.987] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.987] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.987] IWbemClassObject:Get (in: This=0x67e6f8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283e00*=0, plFlavor=0x2283e04*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x2283e00*=8, plFlavor=0x2283e04*=0) returned 0x0 [0222.987] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0222.987] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0222.988] IWbemClassObject:Get (in: This=0x67e6f8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283e00*=8, plFlavor=0x2283e04*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x2283e00*=8, plFlavor=0x2283e04*=0) returned 0x0 [0222.988] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0222.988] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0222.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0222.988] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0222.988] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0222.988] IWbemClassObject:Get (in: This=0x67e6f8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283f44*=0, plFlavor=0x2283f48*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x2283f44*=8, plFlavor=0x2283f48*=0) returned 0x0 [0222.988] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0222.988] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0222.989] IWbemClassObject:Get (in: This=0x67e6f8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2283f44*=8, plFlavor=0x2283f48*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x2283f44*=8, plFlavor=0x2283f48*=0) returned 0x0 [0222.989] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0222.989] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0222.989] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0222.989] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6c86b8, puReturned=0x227e9dc*=0x1) returned 0x0 [0222.991] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6c86b8) returned 0x0 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0222.992] IUnknown:AddRef (This=0x6c86b8) returned 0x3 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0222.992] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6c86bc) returned 0x0 [0222.992] IMarshal:GetUnmarshalClass (in: This=0x6c86bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0222.993] IUnknown:Release (This=0x6c86bc) returned 0x3 [0222.993] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0222.993] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0222.993] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0222.993] IUnknown:Release (This=0x6c86b8) returned 0x2 [0222.993] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0222.993] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0222.993] IUnknown:QueryInterface (in: This=0x6c86b8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6c86b8) returned 0x0 [0222.993] IUnknown:AddRef (This=0x6c86b8) returned 0x4 [0222.993] IUnknown:Release (This=0x6c86b8) returned 0x3 [0222.993] IUnknown:Release (This=0x6c86b8) returned 0x2 [0222.993] CoTaskMemFree (pv=0x6a3ea8) [0222.994] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0222.994] IUnknown:AddRef (This=0x6c86b8) returned 0x3 [0222.994] IWbemClassObject:Get (in: This=0x6c86b8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0222.994] IWbemClassObject:Get (in: This=0x6c86b8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0222.994] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0222.994] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0222.994] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0222.994] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0222.995] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0222.995] IUnknown:Release (This=0x692bc4) returned 0x1 [0222.996] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0222.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0222.996] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6c8850) returned 0x0 [0222.996] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0222.996] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6c8850) returned 0x0 [0222.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0222.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0222.997] WbemDefPath:IUnknown:AddRef (This=0x6c8850) returned 0x3 [0222.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0222.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0222.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6c8c20) returned 0x0 [0222.997] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6c8c20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0222.998] WbemDefPath:IUnknown:Release (This=0x6c8c20) returned 0x3 [0222.998] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0222.998] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0222.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0222.998] WbemDefPath:IUnknown:Release (This=0x6c8850) returned 0x2 [0222.998] WbemDefPath:IUnknown:Release (This=0x6c8850) returned 0x1 [0222.998] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0222.998] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0222.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c8850, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6c8850) returned 0x0 [0222.998] WbemDefPath:IUnknown:AddRef (This=0x6c8850) returned 0x3 [0222.998] WbemDefPath:IUnknown:Release (This=0x6c8850) returned 0x2 [0222.999] WbemDefPath:IWbemPath:SetText (This=0x6c8850, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x0 [0222.999] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0222.999] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0222.999] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.000] IWbemClassObject:Get (in: This=0x6c86b8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22848f4*=0, plFlavor=0x22848f8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x954, varVal2=0x0), pType=0x22848f4*=19, plFlavor=0x22848f8*=0) returned 0x0 [0223.000] IWbemClassObject:Get (in: This=0x6c86b8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22848f4*=19, plFlavor=0x22848f8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x954, varVal2=0x0), pType=0x22848f4*=19, plFlavor=0x22848f8*=0) returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.000] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.001] IWbemClassObject:Get (in: This=0x6c86b8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22849f8*=0, plFlavor=0x22849fc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x22849f8*=8, plFlavor=0x22849fc*=0) returned 0x0 [0223.001] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0223.001] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0223.001] IWbemClassObject:Get (in: This=0x6c86b8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22849f8*=8, plFlavor=0x22849fc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x22849f8*=8, plFlavor=0x22849fc*=0) returned 0x0 [0223.001] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0223.001] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0223.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.001] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.001] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.002] IWbemClassObject:Get (in: This=0x6c86b8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2284b64*=0, plFlavor=0x2284b68*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x2284b64*=8, plFlavor=0x2284b68*=0) returned 0x0 [0223.002] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0223.002] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0223.002] IWbemClassObject:Get (in: This=0x6c86b8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2284b64*=8, plFlavor=0x2284b68*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x2284b64*=8, plFlavor=0x2284b68*=0) returned 0x0 [0223.002] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0223.002] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0223.002] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0223.003] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6c91f0, puReturned=0x227e9dc*=0x1) returned 0x0 [0223.055] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6c91f0) returned 0x0 [0223.055] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0223.055] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0223.055] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0223.055] IUnknown:AddRef (This=0x6c91f0) returned 0x3 [0223.055] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0223.056] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0223.056] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6c91f4) returned 0x0 [0223.056] IMarshal:GetUnmarshalClass (in: This=0x6c91f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0223.056] IUnknown:Release (This=0x6c91f4) returned 0x3 [0223.056] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0223.056] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0223.056] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0223.056] IUnknown:Release (This=0x6c91f0) returned 0x2 [0223.056] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0223.056] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0223.056] IUnknown:QueryInterface (in: This=0x6c91f0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6c91f0) returned 0x0 [0223.057] IUnknown:AddRef (This=0x6c91f0) returned 0x4 [0223.057] IUnknown:Release (This=0x6c91f0) returned 0x3 [0223.057] IUnknown:Release (This=0x6c91f0) returned 0x2 [0223.057] CoTaskMemFree (pv=0x6a3ea8) [0223.057] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0223.057] IUnknown:AddRef (This=0x6c91f0) returned 0x3 [0223.057] IWbemClassObject:Get (in: This=0x6c91f0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0223.057] IWbemClassObject:Get (in: This=0x6c91f0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0223.057] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0223.057] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0223.058] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0223.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0223.058] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0223.058] IUnknown:Release (This=0x692bc4) returned 0x1 [0223.059] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0223.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0223.059] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ca630) returned 0x0 [0223.060] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ca630) returned 0x0 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0223.060] WbemDefPath:IUnknown:AddRef (This=0x6ca630) returned 0x3 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0223.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6c8f38) returned 0x0 [0223.060] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6c8f38, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0223.060] WbemDefPath:IUnknown:Release (This=0x6c8f38) returned 0x3 [0223.061] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0223.061] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0223.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0223.061] WbemDefPath:IUnknown:Release (This=0x6ca630) returned 0x2 [0223.061] WbemDefPath:IUnknown:Release (This=0x6ca630) returned 0x1 [0223.061] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0223.061] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0223.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ca630, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ca630) returned 0x0 [0223.061] WbemDefPath:IUnknown:AddRef (This=0x6ca630) returned 0x3 [0223.061] WbemDefPath:IUnknown:Release (This=0x6ca630) returned 0x2 [0223.062] WbemDefPath:IWbemPath:SetText (This=0x6ca630, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.062] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.062] IWbemClassObject:Get (in: This=0x6c91f0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22857e0*=0, plFlavor=0x22857e4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9dc, varVal2=0x0), pType=0x22857e0*=19, plFlavor=0x22857e4*=0) returned 0x0 [0223.062] IWbemClassObject:Get (in: This=0x6c91f0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22857e0*=19, plFlavor=0x22857e4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9dc, varVal2=0x0), pType=0x22857e0*=19, plFlavor=0x22857e4*=0) returned 0x0 [0223.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.063] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.063] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.063] IWbemClassObject:Get (in: This=0x6c91f0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22858e4*=0, plFlavor=0x22858e8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x22858e4*=8, plFlavor=0x22858e8*=0) returned 0x0 [0223.063] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0223.063] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0223.063] IWbemClassObject:Get (in: This=0x6c91f0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22858e4*=8, plFlavor=0x22858e8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x22858e4*=8, plFlavor=0x22858e8*=0) returned 0x0 [0223.063] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0223.063] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0223.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.064] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.064] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.064] IWbemClassObject:Get (in: This=0x6c91f0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2285a28*=0, plFlavor=0x2285a2c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x2285a28*=8, plFlavor=0x2285a2c*=0) returned 0x0 [0223.064] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0223.064] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0223.064] IWbemClassObject:Get (in: This=0x6c91f0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2285a28*=8, plFlavor=0x2285a2c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x2285a28*=8, plFlavor=0x2285a2c*=0) returned 0x0 [0223.065] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0223.065] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0223.065] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0223.065] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6c96a8, puReturned=0x227e9dc*=0x1) returned 0x0 [0223.068] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6c96a8) returned 0x0 [0223.068] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0223.068] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0223.068] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0223.069] IUnknown:AddRef (This=0x6c96a8) returned 0x3 [0223.069] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0223.069] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0223.069] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6c96ac) returned 0x0 [0223.069] IMarshal:GetUnmarshalClass (in: This=0x6c96ac, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0223.069] IUnknown:Release (This=0x6c96ac) returned 0x3 [0223.069] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0223.069] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0223.069] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0223.070] IUnknown:Release (This=0x6c96a8) returned 0x2 [0223.070] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0223.070] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0223.070] IUnknown:QueryInterface (in: This=0x6c96a8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6c96a8) returned 0x0 [0223.070] IUnknown:AddRef (This=0x6c96a8) returned 0x4 [0223.070] IUnknown:Release (This=0x6c96a8) returned 0x3 [0223.070] IUnknown:Release (This=0x6c96a8) returned 0x2 [0223.070] CoTaskMemFree (pv=0x6a3ea8) [0223.070] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0223.070] IUnknown:AddRef (This=0x6c96a8) returned 0x3 [0223.070] IWbemClassObject:Get (in: This=0x6c96a8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0223.070] IWbemClassObject:Get (in: This=0x6c96a8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0223.071] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0223.071] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0223.071] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0223.071] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0223.071] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0223.071] IUnknown:Release (This=0x692bc4) returned 0x1 [0223.073] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0223.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0223.073] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6c9af8) returned 0x0 [0223.073] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0223.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6c9af8) returned 0x0 [0223.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0223.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0223.074] WbemDefPath:IUnknown:AddRef (This=0x6c9af8) returned 0x3 [0223.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0223.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0223.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6c8a88) returned 0x0 [0223.074] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6c8a88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0223.074] WbemDefPath:IUnknown:Release (This=0x6c8a88) returned 0x3 [0223.074] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0223.074] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0223.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0223.074] WbemDefPath:IUnknown:Release (This=0x6c9af8) returned 0x2 [0223.075] WbemDefPath:IUnknown:Release (This=0x6c9af8) returned 0x1 [0223.075] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0223.075] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0223.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x6c9af8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6c9af8) returned 0x0 [0223.075] WbemDefPath:IUnknown:AddRef (This=0x6c9af8) returned 0x3 [0223.075] WbemDefPath:IUnknown:Release (This=0x6c9af8) returned 0x2 [0223.075] WbemDefPath:IWbemPath:SetText (This=0x6c9af8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.075] IWbemClassObject:Get (in: This=0x6c96a8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22866dc*=0, plFlavor=0x22866e0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb78, varVal2=0x0), pType=0x22866dc*=19, plFlavor=0x22866e0*=0) returned 0x0 [0223.076] IWbemClassObject:Get (in: This=0x6c96a8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22866dc*=19, plFlavor=0x22866e0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb78, varVal2=0x0), pType=0x22866dc*=19, plFlavor=0x22866e0*=0) returned 0x0 [0223.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.076] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.076] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.076] IWbemClassObject:Get (in: This=0x6c96a8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22867e0*=0, plFlavor=0x22867e4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x22867e0*=8, plFlavor=0x22867e4*=0) returned 0x0 [0223.076] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0223.076] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0223.076] IWbemClassObject:Get (in: This=0x6c96a8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22867e0*=8, plFlavor=0x22867e4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x22867e0*=8, plFlavor=0x22867e4*=0) returned 0x0 [0223.077] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0223.077] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0223.077] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0223.077] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0223.077] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0223.077] IWbemClassObject:Get (in: This=0x6c96a8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228691c*=0, plFlavor=0x2286920*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x228691c*=8, plFlavor=0x2286920*=0) returned 0x0 [0223.077] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0223.077] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0223.077] IWbemClassObject:Get (in: This=0x6c96a8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228691c*=8, plFlavor=0x2286920*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x228691c*=8, plFlavor=0x2286920*=0) returned 0x0 [0223.077] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0223.078] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0223.078] CoTaskMemAlloc (cb=0x4) returned 0x6a3ea8 [0223.078] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ea8, puReturned=0x227e9dc | out: apObjects=0x6a3ea8*=0x6cff98, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.093] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6cff98) returned 0x0 [0225.094] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.094] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.094] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.094] IUnknown:AddRef (This=0x6cff98) returned 0x3 [0225.095] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.095] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.095] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6cff9c) returned 0x0 [0225.095] IMarshal:GetUnmarshalClass (in: This=0x6cff9c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.095] IUnknown:Release (This=0x6cff9c) returned 0x3 [0225.095] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.095] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.095] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.095] IUnknown:Release (This=0x6cff98) returned 0x2 [0225.096] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.096] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.096] IUnknown:QueryInterface (in: This=0x6cff98, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6cff98) returned 0x0 [0225.096] IUnknown:AddRef (This=0x6cff98) returned 0x4 [0225.096] IUnknown:Release (This=0x6cff98) returned 0x3 [0225.096] IUnknown:Release (This=0x6cff98) returned 0x2 [0225.096] CoTaskMemFree (pv=0x6a3ea8) [0225.096] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.096] IUnknown:AddRef (This=0x6cff98) returned 0x3 [0225.097] IWbemClassObject:Get (in: This=0x6cff98, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.097] IWbemClassObject:Get (in: This=0x6cff98, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.098] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x5c [0225.098] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x5c [0225.098] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.098] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.099] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.099] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.259] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ea8) returned 0x0 [0225.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ea8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.261] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ea8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0908) returned 0x0 [0225.261] WbemDefPath:IUnknown:Release (This=0x6a3ea8) returned 0x0 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0908) returned 0x0 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.262] WbemDefPath:IUnknown:AddRef (This=0x6d0908) returned 0x3 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6c8a28) returned 0x0 [0225.262] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6c8a28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.262] WbemDefPath:IUnknown:Release (This=0x6c8a28) returned 0x3 [0225.263] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.263] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.263] WbemDefPath:IUnknown:Release (This=0x6d0908) returned 0x2 [0225.263] WbemDefPath:IUnknown:Release (This=0x6d0908) returned 0x1 [0225.263] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.263] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0908, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0908) returned 0x0 [0225.263] WbemDefPath:IUnknown:AddRef (This=0x6d0908) returned 0x3 [0225.263] WbemDefPath:IUnknown:Release (This=0x6d0908) returned 0x2 [0225.263] WbemDefPath:IWbemPath:SetText (This=0x6d0908, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.265] IWbemClassObject:Get (in: This=0x6cff98, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2287370*=0, plFlavor=0x2287374*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3e0, varVal2=0x0), pType=0x2287370*=19, plFlavor=0x2287374*=0) returned 0x0 [0225.265] IWbemClassObject:Get (in: This=0x6cff98, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2287370*=19, plFlavor=0x2287374*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3e0, varVal2=0x0), pType=0x2287370*=19, plFlavor=0x2287374*=0) returned 0x0 [0225.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.266] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.266] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.266] IWbemClassObject:Get (in: This=0x6cff98, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2287470*=0, plFlavor=0x2287474*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x2287470*=8, plFlavor=0x2287474*=0) returned 0x0 [0225.266] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0225.266] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0225.266] IWbemClassObject:Get (in: This=0x6cff98, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2287470*=8, plFlavor=0x2287474*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x2287470*=8, plFlavor=0x2287474*=0) returned 0x0 [0225.267] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0225.267] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0225.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.267] IWbemClassObject:Get (in: This=0x6cff98, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22875dc*=0, plFlavor=0x22875e0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", varVal2=0x0), pType=0x22875dc*=8, plFlavor=0x22875e0*=0) returned 0x0 [0225.267] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca") returned 0xca [0225.267] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca") returned 0xca [0225.267] IWbemClassObject:Get (in: This=0x6cff98, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22875dc*=8, plFlavor=0x22875e0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", varVal2=0x0), pType=0x22875dc*=8, plFlavor=0x22875e0*=0) returned 0x0 [0225.267] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca") returned 0xca [0225.267] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca") returned 0xca [0225.268] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.268] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6c8098, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.270] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6c8098) returned 0x0 [0225.271] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.271] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.272] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.272] IUnknown:AddRef (This=0x6c8098) returned 0x3 [0225.272] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.272] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.272] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6c809c) returned 0x0 [0225.273] IMarshal:GetUnmarshalClass (in: This=0x6c809c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.273] IUnknown:Release (This=0x6c809c) returned 0x3 [0225.273] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.273] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.273] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.273] IUnknown:Release (This=0x6c8098) returned 0x2 [0225.273] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.273] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.274] IUnknown:QueryInterface (in: This=0x6c8098, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6c8098) returned 0x0 [0225.274] IUnknown:AddRef (This=0x6c8098) returned 0x4 [0225.274] IUnknown:Release (This=0x6c8098) returned 0x3 [0225.274] IUnknown:Release (This=0x6c8098) returned 0x2 [0225.274] CoTaskMemFree (pv=0x6a3eb8) [0225.274] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.274] IUnknown:AddRef (This=0x6c8098) returned 0x3 [0225.274] IWbemClassObject:Get (in: This=0x6c8098, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.274] IWbemClassObject:Get (in: This=0x6c8098, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.274] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0225.274] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0225.275] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.275] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.275] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.275] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.276] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.276] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0a58) returned 0x0 [0225.276] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0a58) returned 0x0 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.277] WbemDefPath:IUnknown:AddRef (This=0x6d0a58) returned 0x3 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d0d20) returned 0x0 [0225.277] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d0d20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.278] WbemDefPath:IUnknown:Release (This=0x6d0d20) returned 0x3 [0225.278] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.278] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.278] WbemDefPath:IUnknown:Release (This=0x6d0a58) returned 0x2 [0225.278] WbemDefPath:IUnknown:Release (This=0x6d0a58) returned 0x1 [0225.278] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.278] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0a58, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0a58) returned 0x0 [0225.278] WbemDefPath:IUnknown:AddRef (This=0x6d0a58) returned 0x3 [0225.278] WbemDefPath:IUnknown:Release (This=0x6d0a58) returned 0x2 [0225.278] WbemDefPath:IWbemPath:SetText (This=0x6d0a58, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.279] IWbemClassObject:Get (in: This=0x6c8098, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288170*=0, plFlavor=0x2288174*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8ac, varVal2=0x0), pType=0x2288170*=19, plFlavor=0x2288174*=0) returned 0x0 [0225.279] IWbemClassObject:Get (in: This=0x6c8098, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288170*=19, plFlavor=0x2288174*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8ac, varVal2=0x0), pType=0x2288170*=19, plFlavor=0x2288174*=0) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.279] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.280] IWbemClassObject:Get (in: This=0x6c8098, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288274*=0, plFlavor=0x2288278*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2288274*=8, plFlavor=0x2288278*=0) returned 0x0 [0225.280] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0225.280] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0225.280] IWbemClassObject:Get (in: This=0x6c8098, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288274*=8, plFlavor=0x2288278*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2288274*=8, plFlavor=0x2288278*=0) returned 0x0 [0225.280] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0225.280] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0225.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.280] IWbemClassObject:Get (in: This=0x6c8098, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22883b8*=0, plFlavor=0x22883bc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x22883b8*=8, plFlavor=0x22883bc*=0) returned 0x0 [0225.281] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0225.281] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0225.281] IWbemClassObject:Get (in: This=0x6c8098, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22883b8*=8, plFlavor=0x22883bc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x22883b8*=8, plFlavor=0x22883bc*=0) returned 0x0 [0225.281] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0225.281] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0225.281] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.281] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d2a08, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.456] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d2a08) returned 0x0 [0225.456] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.456] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.456] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.457] IUnknown:AddRef (This=0x6d2a08) returned 0x3 [0225.457] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.457] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.457] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d2a0c) returned 0x0 [0225.457] IMarshal:GetUnmarshalClass (in: This=0x6d2a0c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.457] IUnknown:Release (This=0x6d2a0c) returned 0x3 [0225.457] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.457] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.457] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.457] IUnknown:Release (This=0x6d2a08) returned 0x2 [0225.457] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.457] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.457] IUnknown:QueryInterface (in: This=0x6d2a08, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d2a08) returned 0x0 [0225.457] IUnknown:AddRef (This=0x6d2a08) returned 0x4 [0225.457] IUnknown:Release (This=0x6d2a08) returned 0x3 [0225.457] IUnknown:Release (This=0x6d2a08) returned 0x2 [0225.457] CoTaskMemFree (pv=0x6a3eb8) [0225.458] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.458] IUnknown:AddRef (This=0x6d2a08) returned 0x3 [0225.458] IWbemClassObject:Get (in: This=0x6d2a08, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.458] IWbemClassObject:Get (in: This=0x6d2a08, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.458] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0225.458] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0225.458] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.458] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.458] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.458] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.460] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.460] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d06d8) returned 0x0 [0225.460] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d06d8) returned 0x0 [0225.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.461] WbemDefPath:IUnknown:AddRef (This=0x6d06d8) returned 0x3 [0225.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d0e28) returned 0x0 [0225.461] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d0e28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.461] WbemDefPath:IUnknown:Release (This=0x6d0e28) returned 0x3 [0225.461] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.461] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.461] WbemDefPath:IUnknown:Release (This=0x6d06d8) returned 0x2 [0225.461] WbemDefPath:IUnknown:Release (This=0x6d06d8) returned 0x1 [0225.461] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.461] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d06d8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d06d8) returned 0x0 [0225.461] WbemDefPath:IUnknown:AddRef (This=0x6d06d8) returned 0x3 [0225.461] WbemDefPath:IUnknown:Release (This=0x6d06d8) returned 0x2 [0225.461] WbemDefPath:IWbemPath:SetText (This=0x6d06d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x0 [0225.461] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.461] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.461] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.462] IWbemClassObject:Get (in: This=0x6d2a08, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288e4c*=0, plFlavor=0x2288e50*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x2288e4c*=19, plFlavor=0x2288e50*=0) returned 0x0 [0225.462] IWbemClassObject:Get (in: This=0x6d2a08, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288e4c*=19, plFlavor=0x2288e50*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x2288e4c*=19, plFlavor=0x2288e50*=0) returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.462] IWbemClassObject:Get (in: This=0x6d2a08, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288f50*=0, plFlavor=0x2288f54*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x2288f50*=8, plFlavor=0x2288f54*=0) returned 0x0 [0225.462] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0225.462] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0225.462] IWbemClassObject:Get (in: This=0x6d2a08, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2288f50*=8, plFlavor=0x2288f54*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x2288f50*=8, plFlavor=0x2288f54*=0) returned 0x0 [0225.462] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0225.463] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0225.463] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.463] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.463] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.463] IWbemClassObject:Get (in: This=0x6d2a08, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228909c*=0, plFlavor=0x22890a0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ", varVal2=0x0), pType=0x228909c*=8, plFlavor=0x22890a0*=0) returned 0x0 [0225.463] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0225.463] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0225.463] IWbemClassObject:Get (in: This=0x6d2a08, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228909c*=8, plFlavor=0x22890a0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ", varVal2=0x0), pType=0x228909c*=8, plFlavor=0x22890a0*=0) returned 0x0 [0225.463] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0225.463] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0225.463] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.463] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d2428, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d2428) returned 0x0 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.466] IUnknown:AddRef (This=0x6d2428) returned 0x3 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d242c) returned 0x0 [0225.466] IMarshal:GetUnmarshalClass (in: This=0x6d242c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.466] IUnknown:Release (This=0x6d242c) returned 0x3 [0225.466] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.466] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.466] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.466] IUnknown:Release (This=0x6d2428) returned 0x2 [0225.466] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.467] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.467] IUnknown:QueryInterface (in: This=0x6d2428, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d2428) returned 0x0 [0225.467] IUnknown:AddRef (This=0x6d2428) returned 0x4 [0225.467] IUnknown:Release (This=0x6d2428) returned 0x3 [0225.467] IUnknown:Release (This=0x6d2428) returned 0x2 [0225.467] CoTaskMemFree (pv=0x6a3eb8) [0225.467] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.467] IUnknown:AddRef (This=0x6d2428) returned 0x3 [0225.467] IWbemClassObject:Get (in: This=0x6d2428, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.467] IWbemClassObject:Get (in: This=0x6d2428, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.467] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0225.467] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0225.467] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.467] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.467] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.467] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.468] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.468] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0518) returned 0x0 [0225.468] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0518) returned 0x0 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.469] WbemDefPath:IUnknown:AddRef (This=0x6d0518) returned 0x3 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d11d0) returned 0x0 [0225.469] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d11d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.469] WbemDefPath:IUnknown:Release (This=0x6d11d0) returned 0x3 [0225.469] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.469] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.469] WbemDefPath:IUnknown:Release (This=0x6d0518) returned 0x2 [0225.469] WbemDefPath:IUnknown:Release (This=0x6d0518) returned 0x1 [0225.469] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.469] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0518, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0518) returned 0x0 [0225.469] WbemDefPath:IUnknown:AddRef (This=0x6d0518) returned 0x3 [0225.469] WbemDefPath:IUnknown:Release (This=0x6d0518) returned 0x2 [0225.470] WbemDefPath:IWbemPath:SetText (This=0x6d0518, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.470] IWbemClassObject:Get (in: This=0x6d2428, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289b1c*=0, plFlavor=0x2289b20*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd14, varVal2=0x0), pType=0x2289b1c*=19, plFlavor=0x2289b20*=0) returned 0x0 [0225.470] IWbemClassObject:Get (in: This=0x6d2428, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289b1c*=19, plFlavor=0x2289b20*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd14, varVal2=0x0), pType=0x2289b1c*=19, plFlavor=0x2289b20*=0) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.470] IWbemClassObject:Get (in: This=0x6d2428, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289c20*=0, plFlavor=0x2289c24*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2289c20*=8, plFlavor=0x2289c24*=0) returned 0x0 [0225.470] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0225.470] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0225.470] IWbemClassObject:Get (in: This=0x6d2428, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289c20*=8, plFlavor=0x2289c24*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2289c20*=8, plFlavor=0x2289c24*=0) returned 0x0 [0225.471] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0225.471] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0225.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.471] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.471] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.471] IWbemClassObject:Get (in: This=0x6d2428, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d84*=0, plFlavor=0x2289d88*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ", varVal2=0x0), pType=0x2289d84*=8, plFlavor=0x2289d88*=0) returned 0x0 [0225.471] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0225.471] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0225.471] IWbemClassObject:Get (in: This=0x6d2428, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2289d84*=8, plFlavor=0x2289d88*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ", varVal2=0x0), pType=0x2289d84*=8, plFlavor=0x2289d88*=0) returned 0x0 [0225.471] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0225.471] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0225.471] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.471] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3630, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3630) returned 0x0 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.476] IUnknown:AddRef (This=0x6d3630) returned 0x3 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.476] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3634) returned 0x0 [0225.476] IMarshal:GetUnmarshalClass (in: This=0x6d3634, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.477] IUnknown:Release (This=0x6d3634) returned 0x3 [0225.477] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.477] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.477] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.477] IUnknown:Release (This=0x6d3630) returned 0x2 [0225.477] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.477] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.477] IUnknown:QueryInterface (in: This=0x6d3630, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3630) returned 0x0 [0225.477] IUnknown:AddRef (This=0x6d3630) returned 0x4 [0225.477] IUnknown:Release (This=0x6d3630) returned 0x3 [0225.477] IUnknown:Release (This=0x6d3630) returned 0x2 [0225.477] CoTaskMemFree (pv=0x6a3eb8) [0225.477] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.477] IUnknown:AddRef (This=0x6d3630) returned 0x3 [0225.477] IWbemClassObject:Get (in: This=0x6d3630, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.477] IWbemClassObject:Get (in: This=0x6d3630, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.477] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0225.477] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0225.478] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.478] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.478] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.478] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.478] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.479] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0b38) returned 0x0 [0225.479] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0b38) returned 0x0 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.479] WbemDefPath:IUnknown:AddRef (This=0x6d0b38) returned 0x3 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d1308) returned 0x0 [0225.479] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d1308, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.479] WbemDefPath:IUnknown:Release (This=0x6d1308) returned 0x3 [0225.479] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.479] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.480] WbemDefPath:IUnknown:Release (This=0x6d0b38) returned 0x2 [0225.480] WbemDefPath:IUnknown:Release (This=0x6d0b38) returned 0x1 [0225.480] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.480] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.480] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0b38, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0b38) returned 0x0 [0225.480] WbemDefPath:IUnknown:AddRef (This=0x6d0b38) returned 0x3 [0225.480] WbemDefPath:IUnknown:Release (This=0x6d0b38) returned 0x2 [0225.480] WbemDefPath:IWbemPath:SetText (This=0x6d0b38, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.480] IWbemClassObject:Get (in: This=0x6d3630, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a858*=0, plFlavor=0x228a85c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd20, varVal2=0x0), pType=0x228a858*=19, plFlavor=0x228a85c*=0) returned 0x0 [0225.480] IWbemClassObject:Get (in: This=0x6d3630, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a858*=19, plFlavor=0x228a85c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd20, varVal2=0x0), pType=0x228a858*=19, plFlavor=0x228a85c*=0) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.481] IWbemClassObject:Get (in: This=0x6d3630, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a95c*=0, plFlavor=0x228a960*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x228a95c*=8, plFlavor=0x228a960*=0) returned 0x0 [0225.481] SysStringByteLen (bstr="speak.exe") returned 0x12 [0225.481] SysStringByteLen (bstr="speak.exe") returned 0x12 [0225.481] IWbemClassObject:Get (in: This=0x6d3630, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228a95c*=8, plFlavor=0x228a960*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x228a95c*=8, plFlavor=0x228a960*=0) returned 0x0 [0225.481] SysStringByteLen (bstr="speak.exe") returned 0x12 [0225.481] SysStringByteLen (bstr="speak.exe") returned 0x12 [0225.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.481] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.481] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.481] IWbemClassObject:Get (in: This=0x6d3630, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa90*=0, plFlavor=0x228aa94*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\speak.exe\" ", varVal2=0x0), pType=0x228aa90*=8, plFlavor=0x228aa94*=0) returned 0x0 [0225.481] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0225.481] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0225.481] IWbemClassObject:Get (in: This=0x6d3630, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228aa90*=8, plFlavor=0x228aa94*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\speak.exe\" ", varVal2=0x0), pType=0x228aa90*=8, plFlavor=0x228aa94*=0) returned 0x0 [0225.481] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0225.481] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0225.482] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.482] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d37c8, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.544] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d37c8) returned 0x0 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.545] IUnknown:AddRef (This=0x6d37c8) returned 0x3 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.545] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d37cc) returned 0x0 [0225.546] IMarshal:GetUnmarshalClass (in: This=0x6d37cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.546] IUnknown:Release (This=0x6d37cc) returned 0x3 [0225.546] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.546] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.546] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.546] IUnknown:Release (This=0x6d37c8) returned 0x2 [0225.546] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.546] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.546] IUnknown:QueryInterface (in: This=0x6d37c8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d37c8) returned 0x0 [0225.546] IUnknown:AddRef (This=0x6d37c8) returned 0x4 [0225.547] IUnknown:Release (This=0x6d37c8) returned 0x3 [0225.547] IUnknown:Release (This=0x6d37c8) returned 0x2 [0225.547] CoTaskMemFree (pv=0x6a3eb8) [0225.547] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.547] IUnknown:AddRef (This=0x6d37c8) returned 0x3 [0225.547] IWbemClassObject:Get (in: This=0x6d37c8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.547] IWbemClassObject:Get (in: This=0x6d37c8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.547] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0225.547] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0225.548] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.548] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.548] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.548] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.549] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.549] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0438) returned 0x0 [0225.549] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0438) returned 0x0 [0225.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.550] WbemDefPath:IUnknown:AddRef (This=0x6d0438) returned 0x3 [0225.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d5dc8) returned 0x0 [0225.550] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d5dc8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.550] WbemDefPath:IUnknown:Release (This=0x6d5dc8) returned 0x3 [0225.550] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.550] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.550] WbemDefPath:IUnknown:Release (This=0x6d0438) returned 0x2 [0225.550] WbemDefPath:IUnknown:Release (This=0x6d0438) returned 0x1 [0225.550] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.550] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0438, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0438) returned 0x0 [0225.551] WbemDefPath:IUnknown:AddRef (This=0x6d0438) returned 0x3 [0225.551] WbemDefPath:IUnknown:Release (This=0x6d0438) returned 0x2 [0225.551] WbemDefPath:IWbemPath:SetText (This=0x6d0438, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.551] IWbemClassObject:Get (in: This=0x6d37c8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b4b0*=0, plFlavor=0x228b4b4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd2c, varVal2=0x0), pType=0x228b4b0*=19, plFlavor=0x228b4b4*=0) returned 0x0 [0225.551] IWbemClassObject:Get (in: This=0x6d37c8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b4b0*=19, plFlavor=0x228b4b4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd2c, varVal2=0x0), pType=0x228b4b0*=19, plFlavor=0x228b4b4*=0) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.552] IWbemClassObject:Get (in: This=0x6d37c8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b5b4*=0, plFlavor=0x228b5b8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x228b5b4*=8, plFlavor=0x228b5b8*=0) returned 0x0 [0225.552] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0225.552] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0225.552] IWbemClassObject:Get (in: This=0x6d37c8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b5b4*=8, plFlavor=0x228b5b8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x228b5b4*=8, plFlavor=0x228b5b8*=0) returned 0x0 [0225.552] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0225.552] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0225.552] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.552] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.552] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.552] IWbemClassObject:Get (in: This=0x6d37c8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b740*=0, plFlavor=0x228b744*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ", varVal2=0x0), pType=0x228b740*=8, plFlavor=0x228b744*=0) returned 0x0 [0225.552] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0225.552] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0225.553] IWbemClassObject:Get (in: This=0x6d37c8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228b740*=8, plFlavor=0x228b744*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ", varVal2=0x0), pType=0x228b740*=8, plFlavor=0x228b744*=0) returned 0x0 [0225.553] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0225.553] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0225.553] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.553] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3960, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.555] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3960) returned 0x0 [0225.555] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.555] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.555] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.555] IUnknown:AddRef (This=0x6d3960) returned 0x3 [0225.555] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.556] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.556] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3964) returned 0x0 [0225.556] IMarshal:GetUnmarshalClass (in: This=0x6d3964, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.556] IUnknown:Release (This=0x6d3964) returned 0x3 [0225.556] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.556] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.556] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.556] IUnknown:Release (This=0x6d3960) returned 0x2 [0225.556] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.556] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.556] IUnknown:QueryInterface (in: This=0x6d3960, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3960) returned 0x0 [0225.556] IUnknown:AddRef (This=0x6d3960) returned 0x4 [0225.556] IUnknown:Release (This=0x6d3960) returned 0x3 [0225.557] IUnknown:Release (This=0x6d3960) returned 0x2 [0225.557] CoTaskMemFree (pv=0x6a3eb8) [0225.557] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.557] IUnknown:AddRef (This=0x6d3960) returned 0x3 [0225.557] IWbemClassObject:Get (in: This=0x6d3960, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.557] IWbemClassObject:Get (in: This=0x6d3960, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.557] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0225.557] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0225.557] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.558] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.558] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.559] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0668) returned 0x0 [0225.559] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0668) returned 0x0 [0225.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.559] WbemDefPath:IUnknown:AddRef (This=0x6d0668) returned 0x3 [0225.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d5db0) returned 0x0 [0225.560] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d5db0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.560] WbemDefPath:IUnknown:Release (This=0x6d5db0) returned 0x3 [0225.560] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.560] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.560] WbemDefPath:IUnknown:Release (This=0x6d0668) returned 0x2 [0225.560] WbemDefPath:IUnknown:Release (This=0x6d0668) returned 0x1 [0225.560] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.560] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0668, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0668) returned 0x0 [0225.560] WbemDefPath:IUnknown:AddRef (This=0x6d0668) returned 0x3 [0225.560] WbemDefPath:IUnknown:Release (This=0x6d0668) returned 0x2 [0225.560] WbemDefPath:IWbemPath:SetText (This=0x6d0668, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.561] IWbemClassObject:Get (in: This=0x6d3960, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c264*=0, plFlavor=0x228c268*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd44, varVal2=0x0), pType=0x228c264*=19, plFlavor=0x228c268*=0) returned 0x0 [0225.561] IWbemClassObject:Get (in: This=0x6d3960, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c264*=19, plFlavor=0x228c268*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd44, varVal2=0x0), pType=0x228c264*=19, plFlavor=0x228c268*=0) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.561] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.562] IWbemClassObject:Get (in: This=0x6d3960, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c368*=0, plFlavor=0x228c36c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x228c368*=8, plFlavor=0x228c36c*=0) returned 0x0 [0225.562] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0225.562] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0225.562] IWbemClassObject:Get (in: This=0x6d3960, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c368*=8, plFlavor=0x228c36c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x228c368*=8, plFlavor=0x228c36c*=0) returned 0x0 [0225.562] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0225.562] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0225.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.562] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.562] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.562] IWbemClassObject:Get (in: This=0x6d3960, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c4d4*=0, plFlavor=0x228c4d8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ", varVal2=0x0), pType=0x228c4d4*=8, plFlavor=0x228c4d8*=0) returned 0x0 [0225.562] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0225.562] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0225.562] IWbemClassObject:Get (in: This=0x6d3960, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228c4d4*=8, plFlavor=0x228c4d8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ", varVal2=0x0), pType=0x228c4d4*=8, plFlavor=0x228c4d8*=0) returned 0x0 [0225.563] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0225.563] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0225.563] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.563] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3c90, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.565] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3c90) returned 0x0 [0225.565] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.565] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.565] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.566] IUnknown:AddRef (This=0x6d3c90) returned 0x3 [0225.566] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.566] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.566] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3c94) returned 0x0 [0225.566] IMarshal:GetUnmarshalClass (in: This=0x6d3c94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.566] IUnknown:Release (This=0x6d3c94) returned 0x3 [0225.566] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.566] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.566] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.566] IUnknown:Release (This=0x6d3c90) returned 0x2 [0225.566] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.566] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.566] IUnknown:QueryInterface (in: This=0x6d3c90, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3c90) returned 0x0 [0225.566] IUnknown:AddRef (This=0x6d3c90) returned 0x4 [0225.567] IUnknown:Release (This=0x6d3c90) returned 0x3 [0225.567] IUnknown:Release (This=0x6d3c90) returned 0x2 [0225.567] CoTaskMemFree (pv=0x6a3eb8) [0225.567] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.567] IUnknown:AddRef (This=0x6d3c90) returned 0x3 [0225.567] IWbemClassObject:Get (in: This=0x6d3c90, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.567] IWbemClassObject:Get (in: This=0x6d3c90, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.567] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0225.567] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0225.567] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.568] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.568] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.568] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.571] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.571] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0ac8) returned 0x0 [0225.571] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0ac8) returned 0x0 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.571] WbemDefPath:IUnknown:AddRef (This=0x6d0ac8) returned 0x3 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d5e70) returned 0x0 [0225.572] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d5e70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.572] WbemDefPath:IUnknown:Release (This=0x6d5e70) returned 0x3 [0225.572] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.572] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.572] WbemDefPath:IUnknown:Release (This=0x6d0ac8) returned 0x2 [0225.572] WbemDefPath:IUnknown:Release (This=0x6d0ac8) returned 0x1 [0225.572] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.572] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ac8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0ac8) returned 0x0 [0225.572] WbemDefPath:IUnknown:AddRef (This=0x6d0ac8) returned 0x3 [0225.572] WbemDefPath:IUnknown:Release (This=0x6d0ac8) returned 0x2 [0225.572] WbemDefPath:IWbemPath:SetText (This=0x6d0ac8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.572] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.573] IWbemClassObject:Get (in: This=0x6d3c90, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228cfec*=0, plFlavor=0x228cff0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd4c, varVal2=0x0), pType=0x228cfec*=19, plFlavor=0x228cff0*=0) returned 0x0 [0225.573] IWbemClassObject:Get (in: This=0x6d3c90, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228cfec*=19, plFlavor=0x228cff0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd4c, varVal2=0x0), pType=0x228cfec*=19, plFlavor=0x228cff0*=0) returned 0x0 [0225.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.573] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.573] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.573] IWbemClassObject:Get (in: This=0x6d3c90, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d0f0*=0, plFlavor=0x228d0f4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x228d0f0*=8, plFlavor=0x228d0f4*=0) returned 0x0 [0225.573] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0225.573] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0225.573] IWbemClassObject:Get (in: This=0x6d3c90, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d0f0*=8, plFlavor=0x228d0f4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x228d0f0*=8, plFlavor=0x228d0f4*=0) returned 0x0 [0225.573] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0225.573] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0225.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.574] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.574] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.574] IWbemClassObject:Get (in: This=0x6d3c90, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d234*=0, plFlavor=0x228d238*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ", varVal2=0x0), pType=0x228d234*=8, plFlavor=0x228d238*=0) returned 0x0 [0225.574] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0225.574] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0225.574] IWbemClassObject:Get (in: This=0x6d3c90, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228d234*=8, plFlavor=0x228d238*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ", varVal2=0x0), pType=0x228d234*=8, plFlavor=0x228d238*=0) returned 0x0 [0225.574] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0225.574] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0225.574] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.574] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3e28, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.662] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3e28) returned 0x0 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.663] IUnknown:AddRef (This=0x6d3e28) returned 0x3 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.663] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3e2c) returned 0x0 [0225.664] IMarshal:GetUnmarshalClass (in: This=0x6d3e2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.664] IUnknown:Release (This=0x6d3e2c) returned 0x3 [0225.664] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.664] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.664] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.664] IUnknown:Release (This=0x6d3e28) returned 0x2 [0225.664] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.664] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.664] IUnknown:QueryInterface (in: This=0x6d3e28, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3e28) returned 0x0 [0225.664] IUnknown:AddRef (This=0x6d3e28) returned 0x4 [0225.664] IUnknown:Release (This=0x6d3e28) returned 0x3 [0225.664] IUnknown:Release (This=0x6d3e28) returned 0x2 [0225.664] CoTaskMemFree (pv=0x6a3eb8) [0225.665] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.665] IUnknown:AddRef (This=0x6d3e28) returned 0x3 [0225.665] IWbemClassObject:Get (in: This=0x6d3e28, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.665] IWbemClassObject:Get (in: This=0x6d3e28, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.665] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0225.665] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0225.665] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.665] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.665] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.665] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.667] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0898) returned 0x0 [0225.667] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0898) returned 0x0 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.667] WbemDefPath:IUnknown:AddRef (This=0x6d0898) returned 0x3 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d5eb8) returned 0x0 [0225.667] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d5eb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.668] WbemDefPath:IUnknown:Release (This=0x6d5eb8) returned 0x3 [0225.668] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.668] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.668] WbemDefPath:IUnknown:Release (This=0x6d0898) returned 0x2 [0225.668] WbemDefPath:IUnknown:Release (This=0x6d0898) returned 0x1 [0225.668] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.668] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0898, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0898) returned 0x0 [0225.668] WbemDefPath:IUnknown:AddRef (This=0x6d0898) returned 0x3 [0225.668] WbemDefPath:IUnknown:Release (This=0x6d0898) returned 0x2 [0225.668] WbemDefPath:IWbemPath:SetText (This=0x6d0898, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x0 [0225.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.668] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.669] IWbemClassObject:Get (in: This=0x6d3e28, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dc88*=0, plFlavor=0x228dc8c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd5c, varVal2=0x0), pType=0x228dc88*=19, plFlavor=0x228dc8c*=0) returned 0x0 [0225.669] IWbemClassObject:Get (in: This=0x6d3e28, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dc88*=19, plFlavor=0x228dc8c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd5c, varVal2=0x0), pType=0x228dc88*=19, plFlavor=0x228dc8c*=0) returned 0x0 [0225.670] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.670] IWbemClassObject:Get (in: This=0x6d3e28, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dd8c*=0, plFlavor=0x228dd90*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x228dd8c*=8, plFlavor=0x228dd90*=0) returned 0x0 [0225.670] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0225.670] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0225.670] IWbemClassObject:Get (in: This=0x6d3e28, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dd8c*=8, plFlavor=0x228dd90*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x228dd8c*=8, plFlavor=0x228dd90*=0) returned 0x0 [0225.670] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0225.670] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0225.670] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.671] IWbemClassObject:Get (in: This=0x6d3e28, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dee0*=0, plFlavor=0x228dee4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ", varVal2=0x0), pType=0x228dee0*=8, plFlavor=0x228dee4*=0) returned 0x0 [0225.671] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0225.671] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0225.671] IWbemClassObject:Get (in: This=0x6d3e28, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228dee0*=8, plFlavor=0x228dee4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ", varVal2=0x0), pType=0x228dee0*=8, plFlavor=0x228dee4*=0) returned 0x0 [0225.671] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0225.671] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0225.672] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.672] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3fc0, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.675] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3fc0) returned 0x0 [0225.675] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.675] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.675] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.675] IUnknown:AddRef (This=0x6d3fc0) returned 0x3 [0225.675] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.676] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.676] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3fc4) returned 0x0 [0225.676] IMarshal:GetUnmarshalClass (in: This=0x6d3fc4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.676] IUnknown:Release (This=0x6d3fc4) returned 0x3 [0225.676] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.676] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.676] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.676] IUnknown:Release (This=0x6d3fc0) returned 0x2 [0225.676] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.676] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.677] IUnknown:QueryInterface (in: This=0x6d3fc0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3fc0) returned 0x0 [0225.677] IUnknown:AddRef (This=0x6d3fc0) returned 0x4 [0225.677] IUnknown:Release (This=0x6d3fc0) returned 0x3 [0225.677] IUnknown:Release (This=0x6d3fc0) returned 0x2 [0225.677] CoTaskMemFree (pv=0x6a3eb8) [0225.677] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.677] IUnknown:AddRef (This=0x6d3fc0) returned 0x3 [0225.677] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.678] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0225.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0225.678] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.679] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.679] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.679] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.680] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.680] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d04a8) returned 0x0 [0225.680] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d04a8) returned 0x0 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.681] WbemDefPath:IUnknown:AddRef (This=0x6d04a8) returned 0x3 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d6308) returned 0x0 [0225.681] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d6308, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.681] WbemDefPath:IUnknown:Release (This=0x6d6308) returned 0x3 [0225.681] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.682] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.682] WbemDefPath:IUnknown:Release (This=0x6d04a8) returned 0x2 [0225.682] WbemDefPath:IUnknown:Release (This=0x6d04a8) returned 0x1 [0225.682] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.682] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d04a8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d04a8) returned 0x0 [0225.682] WbemDefPath:IUnknown:AddRef (This=0x6d04a8) returned 0x3 [0225.682] WbemDefPath:IUnknown:Release (This=0x6d04a8) returned 0x2 [0225.682] WbemDefPath:IWbemPath:SetText (This=0x6d04a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x0 [0225.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.683] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.683] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228e91c*=0, plFlavor=0x228e920*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd64, varVal2=0x0), pType=0x228e91c*=19, plFlavor=0x228e920*=0) returned 0x0 [0225.683] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228e91c*=19, plFlavor=0x228e920*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd64, varVal2=0x0), pType=0x228e91c*=19, plFlavor=0x228e920*=0) returned 0x0 [0225.683] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.683] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.683] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.683] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ea20*=0, plFlavor=0x228ea24*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x228ea20*=8, plFlavor=0x228ea24*=0) returned 0x0 [0225.683] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0225.683] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0225.684] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228ea20*=8, plFlavor=0x228ea24*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x228ea20*=8, plFlavor=0x228ea24*=0) returned 0x0 [0225.684] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0225.684] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0225.684] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.684] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.684] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.684] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228eb8c*=0, plFlavor=0x228eb90*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ", varVal2=0x0), pType=0x228eb8c*=8, plFlavor=0x228eb90*=0) returned 0x0 [0225.684] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0225.684] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0225.685] IWbemClassObject:Get (in: This=0x6d3fc0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228eb8c*=8, plFlavor=0x228eb90*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ", varVal2=0x0), pType=0x228eb8c*=8, plFlavor=0x228eb90*=0) returned 0x0 [0225.685] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0225.685] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0225.685] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.685] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3af8, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.687] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3af8) returned 0x0 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.688] IUnknown:AddRef (This=0x6d3af8) returned 0x3 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.688] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d3afc) returned 0x0 [0225.688] IMarshal:GetUnmarshalClass (in: This=0x6d3afc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.688] IUnknown:Release (This=0x6d3afc) returned 0x3 [0225.688] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.689] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.689] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.689] IUnknown:Release (This=0x6d3af8) returned 0x2 [0225.689] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.689] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.689] IUnknown:QueryInterface (in: This=0x6d3af8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3af8) returned 0x0 [0225.689] IUnknown:AddRef (This=0x6d3af8) returned 0x4 [0225.689] IUnknown:Release (This=0x6d3af8) returned 0x3 [0225.689] IUnknown:Release (This=0x6d3af8) returned 0x2 [0225.689] CoTaskMemFree (pv=0x6a3eb8) [0225.689] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.689] IUnknown:AddRef (This=0x6d3af8) returned 0x3 [0225.689] IWbemClassObject:Get (in: This=0x6d3af8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.690] IWbemClassObject:Get (in: This=0x6d3af8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.690] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0225.690] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0225.690] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.690] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.690] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.690] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.691] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.692] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0978) returned 0x0 [0225.692] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0978) returned 0x0 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.692] WbemDefPath:IUnknown:AddRef (This=0x6d0978) returned 0x3 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d72d0) returned 0x0 [0225.693] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d72d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.693] WbemDefPath:IUnknown:Release (This=0x6d72d0) returned 0x3 [0225.693] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.766] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.766] WbemDefPath:IUnknown:Release (This=0x6d0978) returned 0x2 [0225.766] WbemDefPath:IUnknown:Release (This=0x6d0978) returned 0x1 [0225.766] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.766] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0978, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0978) returned 0x0 [0225.767] WbemDefPath:IUnknown:AddRef (This=0x6d0978) returned 0x3 [0225.767] WbemDefPath:IUnknown:Release (This=0x6d0978) returned 0x2 [0225.767] WbemDefPath:IWbemPath:SetText (This=0x6d0978, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.767] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.767] IWbemClassObject:Get (in: This=0x6d3af8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f634*=0, plFlavor=0x228f638*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd74, varVal2=0x0), pType=0x228f634*=19, plFlavor=0x228f638*=0) returned 0x0 [0225.767] IWbemClassObject:Get (in: This=0x6d3af8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f634*=19, plFlavor=0x228f638*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd74, varVal2=0x0), pType=0x228f634*=19, plFlavor=0x228f638*=0) returned 0x0 [0225.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.768] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.768] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.768] IWbemClassObject:Get (in: This=0x6d3af8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f738*=0, plFlavor=0x228f73c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x228f738*=8, plFlavor=0x228f73c*=0) returned 0x0 [0225.768] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0225.768] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0225.768] IWbemClassObject:Get (in: This=0x6d3af8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f738*=8, plFlavor=0x228f73c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x228f738*=8, plFlavor=0x228f73c*=0) returned 0x0 [0225.768] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0225.769] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0225.769] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.769] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.769] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.769] IWbemClassObject:Get (in: This=0x6d3af8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f8a4*=0, plFlavor=0x228f8a8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ", varVal2=0x0), pType=0x228f8a4*=8, plFlavor=0x228f8a8*=0) returned 0x0 [0225.769] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0225.769] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0225.769] IWbemClassObject:Get (in: This=0x6d3af8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x228f8a4*=8, plFlavor=0x228f8a8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ", varVal2=0x0), pType=0x228f8a4*=8, plFlavor=0x228f8a8*=0) returned 0x0 [0225.769] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0225.770] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0225.770] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.770] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d3498, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.772] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d3498) returned 0x0 [0225.772] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.772] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.773] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.773] IUnknown:AddRef (This=0x6d3498) returned 0x3 [0225.773] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.773] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.773] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d349c) returned 0x0 [0225.773] IMarshal:GetUnmarshalClass (in: This=0x6d349c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.773] IUnknown:Release (This=0x6d349c) returned 0x3 [0225.773] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.773] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.773] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.774] IUnknown:Release (This=0x6d3498) returned 0x2 [0225.774] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.774] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.774] IUnknown:QueryInterface (in: This=0x6d3498, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d3498) returned 0x0 [0225.774] IUnknown:AddRef (This=0x6d3498) returned 0x4 [0225.774] IUnknown:Release (This=0x6d3498) returned 0x3 [0225.774] IUnknown:Release (This=0x6d3498) returned 0x2 [0225.774] CoTaskMemFree (pv=0x6a3eb8) [0225.774] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.774] IUnknown:AddRef (This=0x6d3498) returned 0x3 [0225.774] IWbemClassObject:Get (in: This=0x6d3498, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.775] IWbemClassObject:Get (in: This=0x6d3498, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.775] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0225.775] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0225.775] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.775] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.775] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.775] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.777] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.777] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d07b8) returned 0x0 [0225.777] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d07b8) returned 0x0 [0225.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.778] WbemDefPath:IUnknown:AddRef (This=0x6d07b8) returned 0x3 [0225.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d6ca0) returned 0x0 [0225.778] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d6ca0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.778] WbemDefPath:IUnknown:Release (This=0x6d6ca0) returned 0x3 [0225.778] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.778] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.778] WbemDefPath:IUnknown:Release (This=0x6d07b8) returned 0x2 [0225.778] WbemDefPath:IUnknown:Release (This=0x6d07b8) returned 0x1 [0225.778] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.779] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.779] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d07b8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d07b8) returned 0x0 [0225.779] WbemDefPath:IUnknown:AddRef (This=0x6d07b8) returned 0x3 [0225.779] WbemDefPath:IUnknown:Release (This=0x6d07b8) returned 0x2 [0225.779] WbemDefPath:IWbemPath:SetText (This=0x6d07b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x0 [0225.779] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.779] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.779] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.779] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.779] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.780] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.780] IWbemClassObject:Get (in: This=0x6d3498, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22903ac*=0, plFlavor=0x22903b0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd80, varVal2=0x0), pType=0x22903ac*=19, plFlavor=0x22903b0*=0) returned 0x0 [0225.780] IWbemClassObject:Get (in: This=0x6d3498, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22903ac*=19, plFlavor=0x22903b0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd80, varVal2=0x0), pType=0x22903ac*=19, plFlavor=0x22903b0*=0) returned 0x0 [0225.780] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.780] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.780] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.780] IWbemClassObject:Get (in: This=0x6d3498, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22904b0*=0, plFlavor=0x22904b4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x22904b0*=8, plFlavor=0x22904b4*=0) returned 0x0 [0225.781] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0225.781] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0225.781] IWbemClassObject:Get (in: This=0x6d3498, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22904b0*=8, plFlavor=0x22904b4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x22904b0*=8, plFlavor=0x22904b4*=0) returned 0x0 [0225.781] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0225.781] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0225.781] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.781] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.781] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.781] IWbemClassObject:Get (in: This=0x6d3498, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290634*=0, plFlavor=0x2290638*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ", varVal2=0x0), pType=0x2290634*=8, plFlavor=0x2290638*=0) returned 0x0 [0225.782] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0225.782] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0225.782] IWbemClassObject:Get (in: This=0x6d3498, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2290634*=8, plFlavor=0x2290638*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ", varVal2=0x0), pType=0x2290634*=8, plFlavor=0x2290638*=0) returned 0x0 [0225.782] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0225.782] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0225.782] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.782] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d4158, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.784] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d4158) returned 0x0 [0225.784] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.784] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.784] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.785] IUnknown:AddRef (This=0x6d4158) returned 0x3 [0225.785] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.785] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.785] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d415c) returned 0x0 [0225.785] IMarshal:GetUnmarshalClass (in: This=0x6d415c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.785] IUnknown:Release (This=0x6d415c) returned 0x3 [0225.785] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.785] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.785] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.785] IUnknown:Release (This=0x6d4158) returned 0x2 [0225.785] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.785] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.785] IUnknown:QueryInterface (in: This=0x6d4158, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d4158) returned 0x0 [0225.786] IUnknown:AddRef (This=0x6d4158) returned 0x4 [0225.786] IUnknown:Release (This=0x6d4158) returned 0x3 [0225.786] IUnknown:Release (This=0x6d4158) returned 0x2 [0225.786] CoTaskMemFree (pv=0x6a3eb8) [0225.786] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.786] IUnknown:AddRef (This=0x6d4158) returned 0x3 [0225.786] IWbemClassObject:Get (in: This=0x6d4158, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.786] IWbemClassObject:Get (in: This=0x6d4158, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.786] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0225.786] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0225.786] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.786] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.787] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.787] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.788] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.789] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0588) returned 0x0 [0225.789] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0588) returned 0x0 [0225.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.789] WbemDefPath:IUnknown:AddRef (This=0x6d0588) returned 0x3 [0225.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d6cb8) returned 0x0 [0225.790] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d6cb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.790] WbemDefPath:IUnknown:Release (This=0x6d6cb8) returned 0x3 [0225.790] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.790] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.790] WbemDefPath:IUnknown:Release (This=0x6d0588) returned 0x2 [0225.790] WbemDefPath:IUnknown:Release (This=0x6d0588) returned 0x1 [0225.790] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.790] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.790] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0588, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0588) returned 0x0 [0225.790] WbemDefPath:IUnknown:AddRef (This=0x6d0588) returned 0x3 [0225.790] WbemDefPath:IUnknown:Release (This=0x6d0588) returned 0x2 [0225.791] WbemDefPath:IWbemPath:SetText (This=0x6d0588, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.791] IWbemClassObject:Get (in: This=0x6d4158, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291118*=0, plFlavor=0x229111c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd88, varVal2=0x0), pType=0x2291118*=19, plFlavor=0x229111c*=0) returned 0x0 [0225.791] IWbemClassObject:Get (in: This=0x6d4158, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291118*=19, plFlavor=0x229111c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd88, varVal2=0x0), pType=0x2291118*=19, plFlavor=0x229111c*=0) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.791] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.792] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.792] IWbemClassObject:Get (in: This=0x6d4158, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229121c*=0, plFlavor=0x2291220*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x229121c*=8, plFlavor=0x2291220*=0) returned 0x0 [0225.792] SysStringByteLen (bstr="yes.exe") returned 0xe [0225.792] SysStringByteLen (bstr="yes.exe") returned 0xe [0225.792] IWbemClassObject:Get (in: This=0x6d4158, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229121c*=8, plFlavor=0x2291220*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x229121c*=8, plFlavor=0x2291220*=0) returned 0x0 [0225.792] SysStringByteLen (bstr="yes.exe") returned 0xe [0225.792] SysStringByteLen (bstr="yes.exe") returned 0xe [0225.792] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.792] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.792] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.792] IWbemClassObject:Get (in: This=0x6d4158, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291348*=0, plFlavor=0x229134c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ", varVal2=0x0), pType=0x2291348*=8, plFlavor=0x229134c*=0) returned 0x0 [0225.793] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0225.793] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0225.793] IWbemClassObject:Get (in: This=0x6d4158, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291348*=8, plFlavor=0x229134c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ", varVal2=0x0), pType=0x2291348*=8, plFlavor=0x229134c*=0) returned 0x0 [0225.793] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0225.793] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0225.793] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.793] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8678, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.840] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8678) returned 0x0 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.841] IUnknown:AddRef (This=0x6d8678) returned 0x3 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.841] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d867c) returned 0x0 [0225.841] IMarshal:GetUnmarshalClass (in: This=0x6d867c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.841] IUnknown:Release (This=0x6d867c) returned 0x3 [0225.842] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.842] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.842] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.842] IUnknown:Release (This=0x6d8678) returned 0x2 [0225.842] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.842] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.842] IUnknown:QueryInterface (in: This=0x6d8678, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8678) returned 0x0 [0225.842] IUnknown:AddRef (This=0x6d8678) returned 0x4 [0225.842] IUnknown:Release (This=0x6d8678) returned 0x3 [0225.842] IUnknown:Release (This=0x6d8678) returned 0x2 [0225.842] CoTaskMemFree (pv=0x6a3eb8) [0225.842] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.842] IUnknown:AddRef (This=0x6d8678) returned 0x3 [0225.842] IWbemClassObject:Get (in: This=0x6d8678, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.843] IWbemClassObject:Get (in: This=0x6d8678, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.843] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0225.843] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0225.843] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.843] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.843] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.843] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.845] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.845] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0ba8) returned 0x0 [0225.845] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0ba8) returned 0x0 [0225.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.846] WbemDefPath:IUnknown:AddRef (This=0x6d0ba8) returned 0x3 [0225.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d71b0) returned 0x0 [0225.846] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d71b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.846] WbemDefPath:IUnknown:Release (This=0x6d71b0) returned 0x3 [0225.846] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.846] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.846] WbemDefPath:IUnknown:Release (This=0x6d0ba8) returned 0x2 [0225.847] WbemDefPath:IUnknown:Release (This=0x6d0ba8) returned 0x1 [0225.847] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.847] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0ba8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0ba8) returned 0x0 [0225.847] WbemDefPath:IUnknown:AddRef (This=0x6d0ba8) returned 0x3 [0225.847] WbemDefPath:IUnknown:Release (This=0x6d0ba8) returned 0x2 [0225.847] WbemDefPath:IWbemPath:SetText (This=0x6d0ba8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.847] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.848] IWbemClassObject:Get (in: This=0x6d8678, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291d70*=0, plFlavor=0x2291d74*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd9c, varVal2=0x0), pType=0x2291d70*=19, plFlavor=0x2291d74*=0) returned 0x0 [0225.848] IWbemClassObject:Get (in: This=0x6d8678, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291d70*=19, plFlavor=0x2291d74*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd9c, varVal2=0x0), pType=0x2291d70*=19, plFlavor=0x2291d74*=0) returned 0x0 [0225.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.848] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.848] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.848] IWbemClassObject:Get (in: This=0x6d8678, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291e74*=0, plFlavor=0x2291e78*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x2291e74*=8, plFlavor=0x2291e78*=0) returned 0x0 [0225.848] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0225.848] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0225.849] IWbemClassObject:Get (in: This=0x6d8678, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291e74*=8, plFlavor=0x2291e78*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x2291e74*=8, plFlavor=0x2291e78*=0) returned 0x0 [0225.849] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0225.849] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0225.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.850] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.850] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.851] IWbemClassObject:Get (in: This=0x6d8678, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291ff0*=0, plFlavor=0x2291ff4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ", varVal2=0x0), pType=0x2291ff0*=8, plFlavor=0x2291ff4*=0) returned 0x0 [0225.851] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0225.851] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0225.851] IWbemClassObject:Get (in: This=0x6d8678, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2291ff0*=8, plFlavor=0x2291ff4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ", varVal2=0x0), pType=0x2291ff0*=8, plFlavor=0x2291ff4*=0) returned 0x0 [0225.851] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0225.851] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0225.851] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.852] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9338, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.853] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9338) returned 0x0 [0225.853] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.853] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.853] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.854] IUnknown:AddRef (This=0x6d9338) returned 0x3 [0225.854] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.854] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.854] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d933c) returned 0x0 [0225.854] IMarshal:GetUnmarshalClass (in: This=0x6d933c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.854] IUnknown:Release (This=0x6d933c) returned 0x3 [0225.854] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.854] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.854] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.854] IUnknown:Release (This=0x6d9338) returned 0x2 [0225.854] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.855] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.855] IUnknown:QueryInterface (in: This=0x6d9338, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9338) returned 0x0 [0225.855] IUnknown:AddRef (This=0x6d9338) returned 0x4 [0225.855] IUnknown:Release (This=0x6d9338) returned 0x3 [0225.855] IUnknown:Release (This=0x6d9338) returned 0x2 [0225.855] CoTaskMemFree (pv=0x6a3eb8) [0225.855] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.855] IUnknown:AddRef (This=0x6d9338) returned 0x3 [0225.855] IWbemClassObject:Get (in: This=0x6d9338, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.855] IWbemClassObject:Get (in: This=0x6d9338, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0225.855] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0225.855] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.856] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.856] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.856] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.857] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.857] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d05f8) returned 0x0 [0225.857] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d05f8) returned 0x0 [0225.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.857] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.858] WbemDefPath:IUnknown:AddRef (This=0x6d05f8) returned 0x3 [0225.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6d7108) returned 0x0 [0225.858] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6d7108, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.858] WbemDefPath:IUnknown:Release (This=0x6d7108) returned 0x3 [0225.858] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.858] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.858] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.859] WbemDefPath:IUnknown:Release (This=0x6d05f8) returned 0x2 [0225.859] WbemDefPath:IUnknown:Release (This=0x6d05f8) returned 0x1 [0225.859] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.859] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d05f8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d05f8) returned 0x0 [0225.859] WbemDefPath:IUnknown:AddRef (This=0x6d05f8) returned 0x3 [0225.859] WbemDefPath:IUnknown:Release (This=0x6d05f8) returned 0x2 [0225.859] WbemDefPath:IWbemPath:SetText (This=0x6d05f8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.860] IWbemClassObject:Get (in: This=0x6d9338, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292adc*=0, plFlavor=0x2292ae0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xda4, varVal2=0x0), pType=0x2292adc*=19, plFlavor=0x2292ae0*=0) returned 0x0 [0225.860] IWbemClassObject:Get (in: This=0x6d9338, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292adc*=19, plFlavor=0x2292ae0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xda4, varVal2=0x0), pType=0x2292adc*=19, plFlavor=0x2292ae0*=0) returned 0x0 [0225.860] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.860] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.860] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.860] IWbemClassObject:Get (in: This=0x6d9338, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292be0*=0, plFlavor=0x2292be4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x2292be0*=8, plFlavor=0x2292be4*=0) returned 0x0 [0225.860] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0225.860] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0225.861] IWbemClassObject:Get (in: This=0x6d9338, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292be0*=8, plFlavor=0x2292be4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x2292be0*=8, plFlavor=0x2292be4*=0) returned 0x0 [0225.861] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0225.861] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0225.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.861] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.861] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.861] IWbemClassObject:Get (in: This=0x6d9338, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292d2c*=0, plFlavor=0x2292d30*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ", varVal2=0x0), pType=0x2292d2c*=8, plFlavor=0x2292d30*=0) returned 0x0 [0225.861] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0225.861] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0225.862] IWbemClassObject:Get (in: This=0x6d9338, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2292d2c*=8, plFlavor=0x2292d30*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ", varVal2=0x0), pType=0x2292d2c*=8, plFlavor=0x2292d30*=0) returned 0x0 [0225.862] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0225.862] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0225.862] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.862] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d7e80, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.865] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d7e80) returned 0x0 [0225.865] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.866] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.866] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.866] IUnknown:AddRef (This=0x6d7e80) returned 0x3 [0225.866] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.866] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.866] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d7e84) returned 0x0 [0225.866] IMarshal:GetUnmarshalClass (in: This=0x6d7e84, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.866] IUnknown:Release (This=0x6d7e84) returned 0x3 [0225.866] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.867] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.867] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.867] IUnknown:Release (This=0x6d7e80) returned 0x2 [0225.867] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.867] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.867] IUnknown:QueryInterface (in: This=0x6d7e80, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d7e80) returned 0x0 [0225.867] IUnknown:AddRef (This=0x6d7e80) returned 0x4 [0225.867] IUnknown:Release (This=0x6d7e80) returned 0x3 [0225.867] IUnknown:Release (This=0x6d7e80) returned 0x2 [0225.867] CoTaskMemFree (pv=0x6a3eb8) [0225.867] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.867] IUnknown:AddRef (This=0x6d7e80) returned 0x3 [0225.867] IWbemClassObject:Get (in: This=0x6d7e80, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.868] IWbemClassObject:Get (in: This=0x6d7e80, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.868] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0225.868] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0225.868] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.868] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.868] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.868] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.870] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.870] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0748) returned 0x0 [0225.870] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0748) returned 0x0 [0225.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.870] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.871] WbemDefPath:IUnknown:AddRef (This=0x6d0748) returned 0x3 [0225.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6da780) returned 0x0 [0225.871] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6da780, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.871] WbemDefPath:IUnknown:Release (This=0x6da780) returned 0x3 [0225.871] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.871] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.871] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.872] WbemDefPath:IUnknown:Release (This=0x6d0748) returned 0x2 [0225.872] WbemDefPath:IUnknown:Release (This=0x6d0748) returned 0x1 [0225.872] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.872] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0748, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0748) returned 0x0 [0225.872] WbemDefPath:IUnknown:AddRef (This=0x6d0748) returned 0x3 [0225.872] WbemDefPath:IUnknown:Release (This=0x6d0748) returned 0x2 [0225.872] WbemDefPath:IWbemPath:SetText (This=0x6d0748, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x0 [0225.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.872] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.873] IWbemClassObject:Get (in: This=0x6d7e80, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22937a8*=0, plFlavor=0x22937ac*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdb8, varVal2=0x0), pType=0x22937a8*=19, plFlavor=0x22937ac*=0) returned 0x0 [0225.873] IWbemClassObject:Get (in: This=0x6d7e80, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22937a8*=19, plFlavor=0x22937ac*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdb8, varVal2=0x0), pType=0x22937a8*=19, plFlavor=0x22937ac*=0) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.873] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.874] IWbemClassObject:Get (in: This=0x6d7e80, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22938ac*=0, plFlavor=0x22938b0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x22938ac*=8, plFlavor=0x22938b0*=0) returned 0x0 [0225.874] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0225.874] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0225.874] IWbemClassObject:Get (in: This=0x6d7e80, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22938ac*=8, plFlavor=0x22938b0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x22938ac*=8, plFlavor=0x22938b0*=0) returned 0x0 [0225.874] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0225.874] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0225.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.874] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.874] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.875] IWbemClassObject:Get (in: This=0x6d7e80, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293a08*=0, plFlavor=0x2293a0c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\subject_whether.exe\" ", varVal2=0x0), pType=0x2293a08*=8, plFlavor=0x2293a0c*=0) returned 0x0 [0225.875] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0225.875] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0225.875] IWbemClassObject:Get (in: This=0x6d7e80, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2293a08*=8, plFlavor=0x2293a0c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\subject_whether.exe\" ", varVal2=0x0), pType=0x2293a08*=8, plFlavor=0x2293a0c*=0) returned 0x0 [0225.875] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0225.875] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0225.875] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.875] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9800, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.925] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9800) returned 0x0 [0225.925] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.926] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.926] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.926] IUnknown:AddRef (This=0x6d9800) returned 0x3 [0225.926] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.926] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.926] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d9804) returned 0x0 [0225.926] IMarshal:GetUnmarshalClass (in: This=0x6d9804, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.926] IUnknown:Release (This=0x6d9804) returned 0x3 [0225.926] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.927] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.927] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.927] IUnknown:Release (This=0x6d9800) returned 0x2 [0225.927] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.927] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.927] IUnknown:QueryInterface (in: This=0x6d9800, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9800) returned 0x0 [0225.927] IUnknown:AddRef (This=0x6d9800) returned 0x4 [0225.928] IUnknown:Release (This=0x6d9800) returned 0x3 [0225.928] IUnknown:Release (This=0x6d9800) returned 0x2 [0225.928] CoTaskMemFree (pv=0x6a3eb8) [0225.928] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.928] IUnknown:AddRef (This=0x6d9800) returned 0x3 [0225.928] IWbemClassObject:Get (in: This=0x6d9800, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.928] IWbemClassObject:Get (in: This=0x6d9800, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.929] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0225.929] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0225.929] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.929] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.929] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.929] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.931] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.931] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.931] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d0828) returned 0x0 [0225.931] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.931] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d0828) returned 0x0 [0225.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.932] WbemDefPath:IUnknown:AddRef (This=0x6d0828) returned 0x3 [0225.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6dab70) returned 0x0 [0225.932] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6dab70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.932] WbemDefPath:IUnknown:Release (This=0x6dab70) returned 0x3 [0225.933] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.933] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.933] WbemDefPath:IUnknown:Release (This=0x6d0828) returned 0x2 [0225.933] WbemDefPath:IUnknown:Release (This=0x6d0828) returned 0x1 [0225.933] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.933] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d0828, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d0828) returned 0x0 [0225.933] WbemDefPath:IUnknown:AddRef (This=0x6d0828) returned 0x3 [0225.933] WbemDefPath:IUnknown:Release (This=0x6d0828) returned 0x2 [0225.933] WbemDefPath:IWbemPath:SetText (This=0x6d0828, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x0 [0225.933] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.935] IWbemClassObject:Get (in: This=0x6d9800, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294448*=0, plFlavor=0x229444c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x2294448*=19, plFlavor=0x229444c*=0) returned 0x0 [0225.935] IWbemClassObject:Get (in: This=0x6d9800, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294448*=19, plFlavor=0x229444c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x2294448*=19, plFlavor=0x229444c*=0) returned 0x0 [0225.935] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.935] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.935] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.935] IWbemClassObject:Get (in: This=0x6d9800, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229454c*=0, plFlavor=0x2294550*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x229454c*=8, plFlavor=0x2294550*=0) returned 0x0 [0225.935] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0225.936] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0225.936] IWbemClassObject:Get (in: This=0x6d9800, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229454c*=8, plFlavor=0x2294550*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x229454c*=8, plFlavor=0x2294550*=0) returned 0x0 [0225.936] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0225.936] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0225.936] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.936] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.936] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.936] IWbemClassObject:Get (in: This=0x6d9800, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294690*=0, plFlavor=0x2294694*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ", varVal2=0x0), pType=0x2294690*=8, plFlavor=0x2294694*=0) returned 0x0 [0225.937] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0225.937] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0225.937] IWbemClassObject:Get (in: This=0x6d9800, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2294690*=8, plFlavor=0x2294694*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ", varVal2=0x0), pType=0x2294690*=8, plFlavor=0x2294694*=0) returned 0x0 [0225.937] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0225.937] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0225.937] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.937] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9668, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.941] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9668) returned 0x0 [0225.941] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.941] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.941] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.942] IUnknown:AddRef (This=0x6d9668) returned 0x3 [0225.942] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.942] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.942] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d966c) returned 0x0 [0225.942] IMarshal:GetUnmarshalClass (in: This=0x6d966c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.942] IUnknown:Release (This=0x6d966c) returned 0x3 [0225.942] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.942] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.942] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.942] IUnknown:Release (This=0x6d9668) returned 0x2 [0225.942] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.943] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.943] IUnknown:QueryInterface (in: This=0x6d9668, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9668) returned 0x0 [0225.943] IUnknown:AddRef (This=0x6d9668) returned 0x4 [0225.943] IUnknown:Release (This=0x6d9668) returned 0x3 [0225.944] IUnknown:Release (This=0x6d9668) returned 0x2 [0225.944] CoTaskMemFree (pv=0x6a3eb8) [0225.944] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.944] IUnknown:AddRef (This=0x6d9668) returned 0x3 [0225.944] IWbemClassObject:Get (in: This=0x6d9668, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.944] IWbemClassObject:Get (in: This=0x6d9668, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.944] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0225.944] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0225.945] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.945] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.945] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.945] IUnknown:Release (This=0x692bc4) returned 0x1 [0225.946] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0225.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0225.947] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6d09e8) returned 0x0 [0225.947] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0225.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6d09e8) returned 0x0 [0225.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0225.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0225.947] WbemDefPath:IUnknown:AddRef (This=0x6d09e8) returned 0x3 [0225.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0225.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0225.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6da9c0) returned 0x0 [0225.948] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6da9c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0225.948] WbemDefPath:IUnknown:Release (This=0x6da9c0) returned 0x3 [0225.948] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0225.948] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0225.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0225.948] WbemDefPath:IUnknown:Release (This=0x6d09e8) returned 0x2 [0225.948] WbemDefPath:IUnknown:Release (This=0x6d09e8) returned 0x1 [0225.949] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0225.949] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0225.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d09e8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6d09e8) returned 0x0 [0225.949] WbemDefPath:IUnknown:AddRef (This=0x6d09e8) returned 0x3 [0225.949] WbemDefPath:IUnknown:Release (This=0x6d09e8) returned 0x2 [0225.949] WbemDefPath:IWbemPath:SetText (This=0x6d09e8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.949] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.949] IWbemClassObject:Get (in: This=0x6d9668, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22950e4*=0, plFlavor=0x22950e8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd4, varVal2=0x0), pType=0x22950e4*=19, plFlavor=0x22950e8*=0) returned 0x0 [0225.950] IWbemClassObject:Get (in: This=0x6d9668, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22950e4*=19, plFlavor=0x22950e8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd4, varVal2=0x0), pType=0x22950e4*=19, plFlavor=0x22950e8*=0) returned 0x0 [0225.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.950] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.950] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.950] IWbemClassObject:Get (in: This=0x6d9668, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22951e8*=0, plFlavor=0x22951ec*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x22951e8*=8, plFlavor=0x22951ec*=0) returned 0x0 [0225.950] SysStringByteLen (bstr="spend.exe") returned 0x12 [0225.950] SysStringByteLen (bstr="spend.exe") returned 0x12 [0225.951] IWbemClassObject:Get (in: This=0x6d9668, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22951e8*=8, plFlavor=0x22951ec*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x22951e8*=8, plFlavor=0x22951ec*=0) returned 0x0 [0225.951] SysStringByteLen (bstr="spend.exe") returned 0x12 [0225.951] SysStringByteLen (bstr="spend.exe") returned 0x12 [0225.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0225.951] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0225.951] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0225.951] IWbemClassObject:Get (in: This=0x6d9668, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229531c*=0, plFlavor=0x2295320*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ", varVal2=0x0), pType=0x229531c*=8, plFlavor=0x2295320*=0) returned 0x0 [0225.951] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0225.951] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0225.952] IWbemClassObject:Get (in: This=0x6d9668, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229531c*=8, plFlavor=0x2295320*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ", varVal2=0x0), pType=0x229531c*=8, plFlavor=0x2295320*=0) returned 0x0 [0225.952] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0225.952] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0225.952] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0225.952] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8e70, puReturned=0x227e9dc*=0x1) returned 0x0 [0225.954] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8e70) returned 0x0 [0225.954] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0225.954] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0225.954] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0225.954] IUnknown:AddRef (This=0x6d8e70) returned 0x3 [0225.955] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0225.955] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0225.955] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d8e74) returned 0x0 [0225.955] IMarshal:GetUnmarshalClass (in: This=0x6d8e74, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0225.955] IUnknown:Release (This=0x6d8e74) returned 0x3 [0225.955] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0225.955] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0225.955] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0225.955] IUnknown:Release (This=0x6d8e70) returned 0x2 [0225.955] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0225.956] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0225.956] IUnknown:QueryInterface (in: This=0x6d8e70, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8e70) returned 0x0 [0225.956] IUnknown:AddRef (This=0x6d8e70) returned 0x4 [0225.956] IUnknown:Release (This=0x6d8e70) returned 0x3 [0225.956] IUnknown:Release (This=0x6d8e70) returned 0x2 [0225.956] CoTaskMemFree (pv=0x6a3eb8) [0225.956] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0225.956] IUnknown:AddRef (This=0x6d8e70) returned 0x3 [0225.956] IWbemClassObject:Get (in: This=0x6d8e70, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0225.956] IWbemClassObject:Get (in: This=0x6d8e70, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0225.957] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0225.957] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0225.957] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0225.957] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0225.957] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0225.957] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.029] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0226.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.030] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddbd8) returned 0x0 [0226.030] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0226.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddbd8) returned 0x0 [0226.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.031] WbemDefPath:IUnknown:AddRef (This=0x6ddbd8) returned 0x3 [0226.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6dae70) returned 0x0 [0226.032] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6dae70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.036] WbemDefPath:IUnknown:Release (This=0x6dae70) returned 0x3 [0226.036] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.037] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.037] WbemDefPath:IUnknown:Release (This=0x6ddbd8) returned 0x2 [0226.038] WbemDefPath:IUnknown:Release (This=0x6ddbd8) returned 0x1 [0226.038] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.038] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddbd8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddbd8) returned 0x0 [0226.038] WbemDefPath:IUnknown:AddRef (This=0x6ddbd8) returned 0x3 [0226.038] WbemDefPath:IUnknown:Release (This=0x6ddbd8) returned 0x2 [0226.038] WbemDefPath:IWbemPath:SetText (This=0x6ddbd8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x0 [0226.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.039] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.039] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.039] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.039] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.039] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.039] IWbemClassObject:Get (in: This=0x6d8e70, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295d78*=0, plFlavor=0x2295d7c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xddc, varVal2=0x0), pType=0x2295d78*=19, plFlavor=0x2295d7c*=0) returned 0x0 [0226.040] IWbemClassObject:Get (in: This=0x6d8e70, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295d78*=19, plFlavor=0x2295d7c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xddc, varVal2=0x0), pType=0x2295d78*=19, plFlavor=0x2295d7c*=0) returned 0x0 [0226.040] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.040] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.040] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.041] IWbemClassObject:Get (in: This=0x6d8e70, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295e7c*=0, plFlavor=0x2295e80*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x2295e7c*=8, plFlavor=0x2295e80*=0) returned 0x0 [0226.041] SysStringByteLen (bstr="fall.exe") returned 0x10 [0226.041] SysStringByteLen (bstr="fall.exe") returned 0x10 [0226.041] IWbemClassObject:Get (in: This=0x6d8e70, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295e7c*=8, plFlavor=0x2295e80*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x2295e7c*=8, plFlavor=0x2295e80*=0) returned 0x0 [0226.042] SysStringByteLen (bstr="fall.exe") returned 0x10 [0226.042] SysStringByteLen (bstr="fall.exe") returned 0x10 [0226.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.042] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.042] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.042] IWbemClassObject:Get (in: This=0x6d8e70, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295fb0*=0, plFlavor=0x2295fb4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ", varVal2=0x0), pType=0x2295fb0*=8, plFlavor=0x2295fb4*=0) returned 0x0 [0226.043] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0226.043] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0226.044] IWbemClassObject:Get (in: This=0x6d8e70, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2295fb0*=8, plFlavor=0x2295fb4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ", varVal2=0x0), pType=0x2295fb0*=8, plFlavor=0x2295fb4*=0) returned 0x0 [0226.044] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0226.044] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0226.044] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.045] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8810, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.051] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8810) returned 0x0 [0226.054] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.054] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.054] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.055] IUnknown:AddRef (This=0x6d8810) returned 0x3 [0226.055] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.055] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.055] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d8814) returned 0x0 [0226.055] IMarshal:GetUnmarshalClass (in: This=0x6d8814, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.055] IUnknown:Release (This=0x6d8814) returned 0x3 [0226.055] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.055] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.082] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.082] IUnknown:Release (This=0x6d8810) returned 0x2 [0226.082] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.082] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.082] IUnknown:QueryInterface (in: This=0x6d8810, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8810) returned 0x0 [0226.082] IUnknown:AddRef (This=0x6d8810) returned 0x4 [0226.082] IUnknown:Release (This=0x6d8810) returned 0x3 [0226.082] IUnknown:Release (This=0x6d8810) returned 0x2 [0226.082] CoTaskMemFree (pv=0x6a3eb8) [0226.082] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.082] IUnknown:AddRef (This=0x6d8810) returned 0x3 [0226.082] IWbemClassObject:Get (in: This=0x6d8810, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.083] IWbemClassObject:Get (in: This=0x6d8810, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0226.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0226.083] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.084] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.084] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.084] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.085] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.085] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd548) returned 0x0 [0226.086] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd548) returned 0x0 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.086] WbemDefPath:IUnknown:AddRef (This=0x6dd548) returned 0x3 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6dac90) returned 0x0 [0226.086] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6dac90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.086] WbemDefPath:IUnknown:Release (This=0x6dac90) returned 0x3 [0226.087] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.087] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.087] WbemDefPath:IUnknown:Release (This=0x6dd548) returned 0x2 [0226.087] WbemDefPath:IUnknown:Release (This=0x6dd548) returned 0x1 [0226.087] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.087] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd548, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd548) returned 0x0 [0226.087] WbemDefPath:IUnknown:AddRef (This=0x6dd548) returned 0x3 [0226.087] WbemDefPath:IUnknown:Release (This=0x6dd548) returned 0x2 [0226.087] WbemDefPath:IWbemPath:SetText (This=0x6dd548, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.088] IWbemClassObject:Get (in: This=0x6d8810, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296a08*=0, plFlavor=0x2296a0c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdec, varVal2=0x0), pType=0x2296a08*=19, plFlavor=0x2296a0c*=0) returned 0x0 [0226.088] IWbemClassObject:Get (in: This=0x6d8810, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296a08*=19, plFlavor=0x2296a0c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdec, varVal2=0x0), pType=0x2296a08*=19, plFlavor=0x2296a0c*=0) returned 0x0 [0226.089] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.089] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.089] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.089] IWbemClassObject:Get (in: This=0x6d8810, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296b0c*=0, plFlavor=0x2296b10*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x2296b0c*=8, plFlavor=0x2296b10*=0) returned 0x0 [0226.089] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0226.089] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0226.089] IWbemClassObject:Get (in: This=0x6d8810, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296b0c*=8, plFlavor=0x2296b10*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x2296b0c*=8, plFlavor=0x2296b10*=0) returned 0x0 [0226.089] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0226.089] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0226.090] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.090] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.090] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.090] IWbemClassObject:Get (in: This=0x6d8810, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296c40*=0, plFlavor=0x2296c44*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x2296c40*=8, plFlavor=0x2296c44*=0) returned 0x0 [0226.090] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0226.090] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0226.090] IWbemClassObject:Get (in: This=0x6d8810, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2296c40*=8, plFlavor=0x2296c44*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x2296c40*=8, plFlavor=0x2296c44*=0) returned 0x0 [0226.090] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0226.090] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0226.091] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.091] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8348, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.092] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8348) returned 0x0 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.093] IUnknown:AddRef (This=0x6d8348) returned 0x3 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.093] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d834c) returned 0x0 [0226.093] IMarshal:GetUnmarshalClass (in: This=0x6d834c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.093] IUnknown:Release (This=0x6d834c) returned 0x3 [0226.094] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.094] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.094] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.095] IUnknown:Release (This=0x6d8348) returned 0x2 [0226.095] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.095] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.095] IUnknown:QueryInterface (in: This=0x6d8348, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8348) returned 0x0 [0226.095] IUnknown:AddRef (This=0x6d8348) returned 0x4 [0226.100] IUnknown:Release (This=0x6d8348) returned 0x3 [0226.100] IUnknown:Release (This=0x6d8348) returned 0x2 [0226.100] CoTaskMemFree (pv=0x6a3eb8) [0226.100] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.100] IUnknown:AddRef (This=0x6d8348) returned 0x3 [0226.100] IWbemClassObject:Get (in: This=0x6d8348, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.100] IWbemClassObject:Get (in: This=0x6d8348, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.100] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0226.100] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0226.101] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.101] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.101] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.101] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.102] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.103] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddfc8) returned 0x0 [0226.103] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddfc8) returned 0x0 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.103] WbemDefPath:IUnknown:AddRef (This=0x6ddfc8) returned 0x3 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6daed0) returned 0x0 [0226.103] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6daed0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.103] WbemDefPath:IUnknown:Release (This=0x6daed0) returned 0x3 [0226.103] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.104] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.104] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.104] WbemDefPath:IUnknown:Release (This=0x6ddfc8) returned 0x2 [0226.104] WbemDefPath:IUnknown:Release (This=0x6ddfc8) returned 0x1 [0226.104] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.104] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.104] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddfc8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddfc8) returned 0x0 [0226.104] WbemDefPath:IUnknown:AddRef (This=0x6ddfc8) returned 0x3 [0226.104] WbemDefPath:IUnknown:Release (This=0x6ddfc8) returned 0x2 [0226.104] WbemDefPath:IWbemPath:SetText (This=0x6ddfc8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x0 [0226.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.104] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.105] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.105] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.105] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.105] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.105] IWbemClassObject:Get (in: This=0x6d8348, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229766c*=0, plFlavor=0x2297670*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf4, varVal2=0x0), pType=0x229766c*=19, plFlavor=0x2297670*=0) returned 0x0 [0226.105] IWbemClassObject:Get (in: This=0x6d8348, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229766c*=19, plFlavor=0x2297670*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf4, varVal2=0x0), pType=0x229766c*=19, plFlavor=0x2297670*=0) returned 0x0 [0226.105] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.106] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.106] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.106] IWbemClassObject:Get (in: This=0x6d8348, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297770*=0, plFlavor=0x2297774*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x2297770*=8, plFlavor=0x2297774*=0) returned 0x0 [0226.106] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0226.106] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0226.106] IWbemClassObject:Get (in: This=0x6d8348, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2297770*=8, plFlavor=0x2297774*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x2297770*=8, plFlavor=0x2297774*=0) returned 0x0 [0226.106] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0226.106] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0226.106] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.106] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.106] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.106] IWbemClassObject:Get (in: This=0x6d8348, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22978cc*=0, plFlavor=0x22978d0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x22978cc*=8, plFlavor=0x22978d0*=0) returned 0x0 [0226.107] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0226.107] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0226.107] IWbemClassObject:Get (in: This=0x6d8348, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22978cc*=8, plFlavor=0x22978d0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x22978cc*=8, plFlavor=0x22978d0*=0) returned 0x0 [0226.107] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0226.107] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0226.107] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.107] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9b30, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.212] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9b30) returned 0x0 [0226.212] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.212] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.212] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.213] IUnknown:AddRef (This=0x6d9b30) returned 0x3 [0226.213] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.213] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.213] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d9b34) returned 0x0 [0226.213] IMarshal:GetUnmarshalClass (in: This=0x6d9b34, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.213] IUnknown:Release (This=0x6d9b34) returned 0x3 [0226.213] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.213] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.213] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.213] IUnknown:Release (This=0x6d9b30) returned 0x2 [0226.213] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.213] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.213] IUnknown:QueryInterface (in: This=0x6d9b30, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9b30) returned 0x0 [0226.213] IUnknown:AddRef (This=0x6d9b30) returned 0x4 [0226.213] IUnknown:Release (This=0x6d9b30) returned 0x3 [0226.213] IUnknown:Release (This=0x6d9b30) returned 0x2 [0226.214] CoTaskMemFree (pv=0x6a3eb8) [0226.214] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.214] IUnknown:AddRef (This=0x6d9b30) returned 0x3 [0226.214] IWbemClassObject:Get (in: This=0x6d9b30, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.214] IWbemClassObject:Get (in: This=0x6d9b30, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.214] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0226.214] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0226.214] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.214] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.214] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.214] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.216] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.216] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd5b8) returned 0x0 [0226.216] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd5b8) returned 0x0 [0226.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.217] WbemDefPath:IUnknown:AddRef (This=0x6dd5b8) returned 0x3 [0226.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6db068) returned 0x0 [0226.217] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6db068, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.217] WbemDefPath:IUnknown:Release (This=0x6db068) returned 0x3 [0226.217] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.217] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.217] WbemDefPath:IUnknown:Release (This=0x6dd5b8) returned 0x2 [0226.217] WbemDefPath:IUnknown:Release (This=0x6dd5b8) returned 0x1 [0226.217] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.217] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd5b8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd5b8) returned 0x0 [0226.217] WbemDefPath:IUnknown:AddRef (This=0x6dd5b8) returned 0x3 [0226.217] WbemDefPath:IUnknown:Release (This=0x6dd5b8) returned 0x2 [0226.218] WbemDefPath:IWbemPath:SetText (This=0x6dd5b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.218] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.218] IWbemClassObject:Get (in: This=0x6d9b30, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298360*=0, plFlavor=0x2298364*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x2298360*=19, plFlavor=0x2298364*=0) returned 0x0 [0226.218] IWbemClassObject:Get (in: This=0x6d9b30, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298360*=19, plFlavor=0x2298364*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x2298360*=19, plFlavor=0x2298364*=0) returned 0x0 [0226.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.219] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.219] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.219] IWbemClassObject:Get (in: This=0x6d9b30, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298464*=0, plFlavor=0x2298468*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2298464*=8, plFlavor=0x2298468*=0) returned 0x0 [0226.222] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0226.222] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0226.223] IWbemClassObject:Get (in: This=0x6d9b30, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298464*=8, plFlavor=0x2298468*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2298464*=8, plFlavor=0x2298468*=0) returned 0x0 [0226.223] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0226.223] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0226.223] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.223] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.223] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.223] IWbemClassObject:Get (in: This=0x6d9b30, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298598*=0, plFlavor=0x229859c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ", varVal2=0x0), pType=0x2298598*=8, plFlavor=0x229859c*=0) returned 0x0 [0226.223] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0226.223] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0226.223] IWbemClassObject:Get (in: This=0x6d9b30, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298598*=8, plFlavor=0x229859c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ", varVal2=0x0), pType=0x2298598*=8, plFlavor=0x229859c*=0) returned 0x0 [0226.224] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0226.224] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0226.224] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.224] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9998, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.227] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9998) returned 0x0 [0226.227] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.227] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.227] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.228] IUnknown:AddRef (This=0x6d9998) returned 0x3 [0226.228] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.228] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.228] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d999c) returned 0x0 [0226.228] IMarshal:GetUnmarshalClass (in: This=0x6d999c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.228] IUnknown:Release (This=0x6d999c) returned 0x3 [0226.228] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.228] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.228] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.228] IUnknown:Release (This=0x6d9998) returned 0x2 [0226.228] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.229] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.229] IUnknown:QueryInterface (in: This=0x6d9998, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9998) returned 0x0 [0226.229] IUnknown:AddRef (This=0x6d9998) returned 0x4 [0226.229] IUnknown:Release (This=0x6d9998) returned 0x3 [0226.229] IUnknown:Release (This=0x6d9998) returned 0x2 [0226.229] CoTaskMemFree (pv=0x6a3eb8) [0226.229] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.229] IUnknown:AddRef (This=0x6d9998) returned 0x3 [0226.229] IWbemClassObject:Get (in: This=0x6d9998, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.229] IWbemClassObject:Get (in: This=0x6d9998, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.230] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0226.230] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0226.230] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.230] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.230] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.230] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.231] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.232] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd628) returned 0x0 [0226.232] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd628) returned 0x0 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.232] WbemDefPath:IUnknown:AddRef (This=0x6dd628) returned 0x3 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6da5a0) returned 0x0 [0226.233] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6da5a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.233] WbemDefPath:IUnknown:Release (This=0x6da5a0) returned 0x3 [0226.233] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.233] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.233] WbemDefPath:IUnknown:Release (This=0x6dd628) returned 0x2 [0226.233] WbemDefPath:IUnknown:Release (This=0x6dd628) returned 0x1 [0226.233] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.233] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd628, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd628) returned 0x0 [0226.234] WbemDefPath:IUnknown:AddRef (This=0x6dd628) returned 0x3 [0226.234] WbemDefPath:IUnknown:Release (This=0x6dd628) returned 0x2 [0226.234] WbemDefPath:IWbemPath:SetText (This=0x6dd628, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.234] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.234] IWbemClassObject:Get (in: This=0x6d9998, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298fe8*=0, plFlavor=0x2298fec*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe0c, varVal2=0x0), pType=0x2298fe8*=19, plFlavor=0x2298fec*=0) returned 0x0 [0226.305] IWbemClassObject:Get (in: This=0x6d9998, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2298fe8*=19, plFlavor=0x2298fec*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe0c, varVal2=0x0), pType=0x2298fe8*=19, plFlavor=0x2298fec*=0) returned 0x0 [0226.305] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.305] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.305] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.306] IWbemClassObject:Get (in: This=0x6d9998, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22990ec*=0, plFlavor=0x22990f0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x22990ec*=8, plFlavor=0x22990f0*=0) returned 0x0 [0226.306] SysStringByteLen (bstr="barca.exe") returned 0x12 [0226.306] SysStringByteLen (bstr="barca.exe") returned 0x12 [0226.306] IWbemClassObject:Get (in: This=0x6d9998, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22990ec*=8, plFlavor=0x22990f0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x22990ec*=8, plFlavor=0x22990f0*=0) returned 0x0 [0226.306] SysStringByteLen (bstr="barca.exe") returned 0x12 [0226.306] SysStringByteLen (bstr="barca.exe") returned 0x12 [0226.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.306] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.307] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.307] IWbemClassObject:Get (in: This=0x6d9998, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299220*=0, plFlavor=0x2299224*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\barca.exe\" ", varVal2=0x0), pType=0x2299220*=8, plFlavor=0x2299224*=0) returned 0x0 [0226.307] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0226.307] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0226.307] IWbemClassObject:Get (in: This=0x6d9998, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299220*=8, plFlavor=0x2299224*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\barca.exe\" ", varVal2=0x0), pType=0x2299220*=8, plFlavor=0x2299224*=0) returned 0x0 [0226.307] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0226.307] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0226.307] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.307] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d7ce8, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.309] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d7ce8) returned 0x0 [0226.309] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.309] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.309] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.310] IUnknown:AddRef (This=0x6d7ce8) returned 0x3 [0226.310] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.310] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.310] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d7cec) returned 0x0 [0226.310] IMarshal:GetUnmarshalClass (in: This=0x6d7cec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.310] IUnknown:Release (This=0x6d7cec) returned 0x3 [0226.310] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.310] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.310] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.310] IUnknown:Release (This=0x6d7ce8) returned 0x2 [0226.310] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.310] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.310] IUnknown:QueryInterface (in: This=0x6d7ce8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d7ce8) returned 0x0 [0226.310] IUnknown:AddRef (This=0x6d7ce8) returned 0x4 [0226.310] IUnknown:Release (This=0x6d7ce8) returned 0x3 [0226.311] IUnknown:Release (This=0x6d7ce8) returned 0x2 [0226.311] CoTaskMemFree (pv=0x6a3eb8) [0226.311] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.311] IUnknown:AddRef (This=0x6d7ce8) returned 0x3 [0226.311] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.311] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.311] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0226.311] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0226.311] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.311] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.311] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.311] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.316] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0226.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.316] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd698) returned 0x0 [0226.316] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0226.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd698) returned 0x0 [0226.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.317] WbemDefPath:IUnknown:AddRef (This=0x6dd698) returned 0x3 [0226.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6da360) returned 0x0 [0226.317] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6da360, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.317] WbemDefPath:IUnknown:Release (This=0x6da360) returned 0x3 [0226.317] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.318] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.318] WbemDefPath:IUnknown:Release (This=0x6dd698) returned 0x2 [0226.318] WbemDefPath:IUnknown:Release (This=0x6dd698) returned 0x1 [0226.318] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.318] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.318] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd698, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd698) returned 0x0 [0226.318] WbemDefPath:IUnknown:AddRef (This=0x6dd698) returned 0x3 [0226.318] WbemDefPath:IUnknown:Release (This=0x6dd698) returned 0x2 [0226.318] WbemDefPath:IWbemPath:SetText (This=0x6dd698, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.319] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299d40*=0, plFlavor=0x2299d44*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe14, varVal2=0x0), pType=0x2299d40*=19, plFlavor=0x2299d44*=0) returned 0x0 [0226.319] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299d40*=19, plFlavor=0x2299d44*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe14, varVal2=0x0), pType=0x2299d40*=19, plFlavor=0x2299d44*=0) returned 0x0 [0226.319] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.320] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.320] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.320] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299e44*=0, plFlavor=0x2299e48*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2299e44*=8, plFlavor=0x2299e48*=0) returned 0x0 [0226.320] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0226.320] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0226.320] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299e44*=8, plFlavor=0x2299e48*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2299e44*=8, plFlavor=0x2299e48*=0) returned 0x0 [0226.320] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0226.320] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0226.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.320] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.320] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.321] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299f88*=0, plFlavor=0x2299f8c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ", varVal2=0x0), pType=0x2299f88*=8, plFlavor=0x2299f8c*=0) returned 0x0 [0226.321] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0226.321] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0226.321] IWbemClassObject:Get (in: This=0x6d7ce8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2299f88*=8, plFlavor=0x2299f8c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ", varVal2=0x0), pType=0x2299f88*=8, plFlavor=0x2299f8c*=0) returned 0x0 [0226.321] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0226.321] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0226.321] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.321] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8018, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.426] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8018) returned 0x0 [0226.427] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.427] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.427] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.427] IUnknown:AddRef (This=0x6d8018) returned 0x3 [0226.428] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.428] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.428] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d801c) returned 0x0 [0226.428] IMarshal:GetUnmarshalClass (in: This=0x6d801c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.428] IUnknown:Release (This=0x6d801c) returned 0x3 [0226.428] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.428] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.429] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.429] IUnknown:Release (This=0x6d8018) returned 0x2 [0226.429] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.429] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.429] IUnknown:QueryInterface (in: This=0x6d8018, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8018) returned 0x0 [0226.429] IUnknown:AddRef (This=0x6d8018) returned 0x4 [0226.429] IUnknown:Release (This=0x6d8018) returned 0x3 [0226.429] IUnknown:Release (This=0x6d8018) returned 0x2 [0226.429] CoTaskMemFree (pv=0x6a3eb8) [0226.429] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.429] IUnknown:AddRef (This=0x6d8018) returned 0x3 [0226.429] IWbemClassObject:Get (in: This=0x6d8018, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.430] IWbemClassObject:Get (in: This=0x6d8018, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.430] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0226.430] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0226.430] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.430] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.430] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.431] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.432] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.432] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddcb8) returned 0x0 [0226.432] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddcb8) returned 0x0 [0226.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.433] WbemDefPath:IUnknown:AddRef (This=0x6ddcb8) returned 0x3 [0226.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6df9c8) returned 0x0 [0226.433] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6df9c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.433] WbemDefPath:IUnknown:Release (This=0x6df9c8) returned 0x3 [0226.433] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.434] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.434] WbemDefPath:IUnknown:Release (This=0x6ddcb8) returned 0x2 [0226.434] WbemDefPath:IUnknown:Release (This=0x6ddcb8) returned 0x1 [0226.434] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.434] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddcb8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddcb8) returned 0x0 [0226.434] WbemDefPath:IUnknown:AddRef (This=0x6ddcb8) returned 0x3 [0226.434] WbemDefPath:IUnknown:Release (This=0x6ddcb8) returned 0x2 [0226.434] WbemDefPath:IWbemPath:SetText (This=0x6ddcb8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x0 [0226.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.435] IWbemClassObject:Get (in: This=0x6d8018, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229a9d4*=0, plFlavor=0x229a9d8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe24, varVal2=0x0), pType=0x229a9d4*=19, plFlavor=0x229a9d8*=0) returned 0x0 [0226.435] IWbemClassObject:Get (in: This=0x6d8018, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229a9d4*=19, plFlavor=0x229a9d8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe24, varVal2=0x0), pType=0x229a9d4*=19, plFlavor=0x229a9d8*=0) returned 0x0 [0226.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.436] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.436] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.436] IWbemClassObject:Get (in: This=0x6d8018, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229aad8*=0, plFlavor=0x229aadc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x229aad8*=8, plFlavor=0x229aadc*=0) returned 0x0 [0226.436] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0226.436] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0226.436] IWbemClassObject:Get (in: This=0x6d8018, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229aad8*=8, plFlavor=0x229aadc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x229aad8*=8, plFlavor=0x229aadc*=0) returned 0x0 [0226.436] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0226.436] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0226.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.437] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.437] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.437] IWbemClassObject:Get (in: This=0x6d8018, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ac14*=0, plFlavor=0x229ac18*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ", varVal2=0x0), pType=0x229ac14*=8, plFlavor=0x229ac18*=0) returned 0x0 [0226.437] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0226.437] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0226.437] IWbemClassObject:Get (in: This=0x6d8018, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229ac14*=8, plFlavor=0x229ac18*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ", varVal2=0x0), pType=0x229ac14*=8, plFlavor=0x229ac18*=0) returned 0x0 [0226.437] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0226.437] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0226.437] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.439] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d84e0, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d84e0) returned 0x0 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.442] IUnknown:AddRef (This=0x6d84e0) returned 0x3 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.442] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d84e4) returned 0x0 [0226.443] IMarshal:GetUnmarshalClass (in: This=0x6d84e4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.443] IUnknown:Release (This=0x6d84e4) returned 0x3 [0226.443] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.443] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.443] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.443] IUnknown:Release (This=0x6d84e0) returned 0x2 [0226.443] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.443] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.443] IUnknown:QueryInterface (in: This=0x6d84e0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d84e0) returned 0x0 [0226.443] IUnknown:AddRef (This=0x6d84e0) returned 0x4 [0226.443] IUnknown:Release (This=0x6d84e0) returned 0x3 [0226.443] IUnknown:Release (This=0x6d84e0) returned 0x2 [0226.444] CoTaskMemFree (pv=0x6a3eb8) [0226.444] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.444] IUnknown:AddRef (This=0x6d84e0) returned 0x3 [0226.444] IWbemClassObject:Get (in: This=0x6d84e0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.444] IWbemClassObject:Get (in: This=0x6d84e0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.444] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0226.444] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0226.444] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.445] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.445] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.445] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.446] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.446] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddb68) returned 0x0 [0226.446] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddb68) returned 0x0 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.447] WbemDefPath:IUnknown:AddRef (This=0x6ddb68) returned 0x3 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6df818) returned 0x0 [0226.447] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6df818, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.447] WbemDefPath:IUnknown:Release (This=0x6df818) returned 0x3 [0226.447] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.448] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.448] WbemDefPath:IUnknown:Release (This=0x6ddb68) returned 0x2 [0226.448] WbemDefPath:IUnknown:Release (This=0x6ddb68) returned 0x1 [0226.448] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.448] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddb68, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddb68) returned 0x0 [0226.448] WbemDefPath:IUnknown:AddRef (This=0x6ddb68) returned 0x3 [0226.448] WbemDefPath:IUnknown:Release (This=0x6ddb68) returned 0x2 [0226.448] WbemDefPath:IWbemPath:SetText (This=0x6ddb68, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x0 [0226.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.448] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.448] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.449] IWbemClassObject:Get (in: This=0x6d84e0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b674*=0, plFlavor=0x229b678*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe34, varVal2=0x0), pType=0x229b674*=19, plFlavor=0x229b678*=0) returned 0x0 [0226.449] IWbemClassObject:Get (in: This=0x6d84e0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b674*=19, plFlavor=0x229b678*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe34, varVal2=0x0), pType=0x229b674*=19, plFlavor=0x229b678*=0) returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.449] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.449] IWbemClassObject:Get (in: This=0x6d84e0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b778*=0, plFlavor=0x229b77c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x229b778*=8, plFlavor=0x229b77c*=0) returned 0x0 [0226.449] SysStringByteLen (bstr="far.exe") returned 0xe [0226.449] SysStringByteLen (bstr="far.exe") returned 0xe [0226.450] IWbemClassObject:Get (in: This=0x6d84e0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b778*=8, plFlavor=0x229b77c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x229b778*=8, plFlavor=0x229b77c*=0) returned 0x0 [0226.450] SysStringByteLen (bstr="far.exe") returned 0xe [0226.450] SysStringByteLen (bstr="far.exe") returned 0xe [0226.450] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.450] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.450] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.450] IWbemClassObject:Get (in: This=0x6d84e0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b8a4*=0, plFlavor=0x229b8a8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ", varVal2=0x0), pType=0x229b8a4*=8, plFlavor=0x229b8a8*=0) returned 0x0 [0226.450] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0226.450] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0226.451] IWbemClassObject:Get (in: This=0x6d84e0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229b8a4*=8, plFlavor=0x229b8a8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ", varVal2=0x0), pType=0x229b8a4*=8, plFlavor=0x229b8a8*=0) returned 0x0 [0226.451] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0226.451] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0226.451] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.451] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d81b0, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.454] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d81b0) returned 0x0 [0226.454] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.454] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.454] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.455] IUnknown:AddRef (This=0x6d81b0) returned 0x3 [0226.455] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.455] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.455] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d81b4) returned 0x0 [0226.455] IMarshal:GetUnmarshalClass (in: This=0x6d81b4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.455] IUnknown:Release (This=0x6d81b4) returned 0x3 [0226.455] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.455] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.455] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.455] IUnknown:Release (This=0x6d81b0) returned 0x2 [0226.455] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.456] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.456] IUnknown:QueryInterface (in: This=0x6d81b0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d81b0) returned 0x0 [0226.456] IUnknown:AddRef (This=0x6d81b0) returned 0x4 [0226.456] IUnknown:Release (This=0x6d81b0) returned 0x3 [0226.456] IUnknown:Release (This=0x6d81b0) returned 0x2 [0226.456] CoTaskMemFree (pv=0x6a3eb8) [0226.456] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.456] IUnknown:AddRef (This=0x6d81b0) returned 0x3 [0226.456] IWbemClassObject:Get (in: This=0x6d81b0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.456] IWbemClassObject:Get (in: This=0x6d81b0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.456] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0226.456] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0226.457] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.457] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.457] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.457] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.458] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.458] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.458] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd708) returned 0x0 [0226.459] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd708) returned 0x0 [0226.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.459] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.460] WbemDefPath:IUnknown:AddRef (This=0x6dd708) returned 0x3 [0226.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.460] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6dfbd8) returned 0x0 [0226.461] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6dfbd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.461] WbemDefPath:IUnknown:Release (This=0x6dfbd8) returned 0x3 [0226.461] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.461] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.461] WbemDefPath:IUnknown:Release (This=0x6dd708) returned 0x2 [0226.461] WbemDefPath:IUnknown:Release (This=0x6dd708) returned 0x1 [0226.461] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.461] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.461] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd708, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd708) returned 0x0 [0226.462] WbemDefPath:IUnknown:AddRef (This=0x6dd708) returned 0x3 [0226.462] WbemDefPath:IUnknown:Release (This=0x6dd708) returned 0x2 [0226.462] WbemDefPath:IWbemPath:SetText (This=0x6dd708, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.462] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.462] IWbemClassObject:Get (in: This=0x6d81b0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c2d8*=0, plFlavor=0x229c2dc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe3c, varVal2=0x0), pType=0x229c2d8*=19, plFlavor=0x229c2dc*=0) returned 0x0 [0226.462] IWbemClassObject:Get (in: This=0x6d81b0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c2d8*=19, plFlavor=0x229c2dc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe3c, varVal2=0x0), pType=0x229c2d8*=19, plFlavor=0x229c2dc*=0) returned 0x0 [0226.463] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.463] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.463] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.463] IWbemClassObject:Get (in: This=0x6d81b0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c3dc*=0, plFlavor=0x229c3e0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x229c3dc*=8, plFlavor=0x229c3e0*=0) returned 0x0 [0226.463] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0226.463] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0226.463] IWbemClassObject:Get (in: This=0x6d81b0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c3dc*=8, plFlavor=0x229c3e0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x229c3dc*=8, plFlavor=0x229c3e0*=0) returned 0x0 [0226.463] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0226.464] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0226.464] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.464] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.464] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.464] IWbemClassObject:Get (in: This=0x6d81b0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c520*=0, plFlavor=0x229c524*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ", varVal2=0x0), pType=0x229c520*=8, plFlavor=0x229c524*=0) returned 0x0 [0226.464] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0226.464] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0226.464] IWbemClassObject:Get (in: This=0x6d81b0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229c520*=8, plFlavor=0x229c524*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ", varVal2=0x0), pType=0x229c520*=8, plFlavor=0x229c524*=0) returned 0x0 [0226.465] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0226.465] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0226.465] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.465] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d89a8, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d89a8) returned 0x0 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.519] IUnknown:AddRef (This=0x6d89a8) returned 0x3 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.519] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.520] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d89ac) returned 0x0 [0226.520] IMarshal:GetUnmarshalClass (in: This=0x6d89ac, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.520] IUnknown:Release (This=0x6d89ac) returned 0x3 [0226.520] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.520] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.520] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.520] IUnknown:Release (This=0x6d89a8) returned 0x2 [0226.520] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.520] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.520] IUnknown:QueryInterface (in: This=0x6d89a8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d89a8) returned 0x0 [0226.520] IUnknown:AddRef (This=0x6d89a8) returned 0x4 [0226.520] IUnknown:Release (This=0x6d89a8) returned 0x3 [0226.521] IUnknown:Release (This=0x6d89a8) returned 0x2 [0226.521] CoTaskMemFree (pv=0x6a3eb8) [0226.521] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.521] IUnknown:AddRef (This=0x6d89a8) returned 0x3 [0226.521] IWbemClassObject:Get (in: This=0x6d89a8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.521] IWbemClassObject:Get (in: This=0x6d89a8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.521] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0226.521] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0226.521] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.522] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.522] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.522] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.523] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.523] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de0a8) returned 0x0 [0226.523] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de0a8) returned 0x0 [0226.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.524] WbemDefPath:IUnknown:AddRef (This=0x6de0a8) returned 0x3 [0226.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e00e8) returned 0x0 [0226.524] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e00e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.524] WbemDefPath:IUnknown:Release (This=0x6e00e8) returned 0x3 [0226.524] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.524] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.525] WbemDefPath:IUnknown:Release (This=0x6de0a8) returned 0x2 [0226.525] WbemDefPath:IUnknown:Release (This=0x6de0a8) returned 0x1 [0226.525] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.525] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de0a8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de0a8) returned 0x0 [0226.525] WbemDefPath:IUnknown:AddRef (This=0x6de0a8) returned 0x3 [0226.525] WbemDefPath:IUnknown:Release (This=0x6de0a8) returned 0x2 [0226.525] WbemDefPath:IWbemPath:SetText (This=0x6de0a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.525] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.525] IWbemClassObject:Get (in: This=0x6d89a8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229cf90*=0, plFlavor=0x229cf94*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe4c, varVal2=0x0), pType=0x229cf90*=19, plFlavor=0x229cf94*=0) returned 0x0 [0226.526] IWbemClassObject:Get (in: This=0x6d89a8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229cf90*=19, plFlavor=0x229cf94*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe4c, varVal2=0x0), pType=0x229cf90*=19, plFlavor=0x229cf94*=0) returned 0x0 [0226.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.526] IWbemClassObject:Get (in: This=0x6d89a8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229d094*=0, plFlavor=0x229d098*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x229d094*=8, plFlavor=0x229d098*=0) returned 0x0 [0226.526] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0226.526] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0226.526] IWbemClassObject:Get (in: This=0x6d89a8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229d094*=8, plFlavor=0x229d098*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x229d094*=8, plFlavor=0x229d098*=0) returned 0x0 [0226.527] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0226.527] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0226.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.527] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.527] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.527] IWbemClassObject:Get (in: This=0x6d89a8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229d1d8*=0, plFlavor=0x229d1dc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ", varVal2=0x0), pType=0x229d1d8*=8, plFlavor=0x229d1dc*=0) returned 0x0 [0226.527] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0226.527] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0226.527] IWbemClassObject:Get (in: This=0x6d89a8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229d1d8*=8, plFlavor=0x229d1dc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ", varVal2=0x0), pType=0x229d1d8*=8, plFlavor=0x229d1dc*=0) returned 0x0 [0226.528] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0226.528] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0226.528] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.528] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8b40, puReturned=0x227e9dc*=0x1) returned 0x0 [0226.529] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8b40) returned 0x0 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0226.530] IUnknown:AddRef (This=0x6d8b40) returned 0x3 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0226.530] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d8b44) returned 0x0 [0226.530] IMarshal:GetUnmarshalClass (in: This=0x6d8b44, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0226.530] IUnknown:Release (This=0x6d8b44) returned 0x3 [0226.531] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0226.531] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0226.531] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0226.531] IUnknown:Release (This=0x6d8b40) returned 0x2 [0226.531] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0226.531] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0226.531] IUnknown:QueryInterface (in: This=0x6d8b40, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8b40) returned 0x0 [0226.531] IUnknown:AddRef (This=0x6d8b40) returned 0x4 [0226.532] IUnknown:Release (This=0x6d8b40) returned 0x3 [0226.532] IUnknown:Release (This=0x6d8b40) returned 0x2 [0226.532] CoTaskMemFree (pv=0x6a3eb8) [0226.532] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0226.532] IUnknown:AddRef (This=0x6d8b40) returned 0x3 [0226.532] IWbemClassObject:Get (in: This=0x6d8b40, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0226.533] IWbemClassObject:Get (in: This=0x6d8b40, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0226.533] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0226.533] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0226.533] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0226.533] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0226.533] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0226.533] IUnknown:Release (This=0x692bc4) returned 0x1 [0226.535] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0226.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0226.535] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de038) returned 0x0 [0226.535] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0226.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de038) returned 0x0 [0226.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0226.535] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0226.536] WbemDefPath:IUnknown:AddRef (This=0x6de038) returned 0x3 [0226.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0226.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0226.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6dfec0) returned 0x0 [0226.536] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6dfec0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0226.536] WbemDefPath:IUnknown:Release (This=0x6dfec0) returned 0x3 [0226.536] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0226.536] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0226.536] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0226.536] WbemDefPath:IUnknown:Release (This=0x6de038) returned 0x2 [0226.536] WbemDefPath:IUnknown:Release (This=0x6de038) returned 0x1 [0226.536] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0226.537] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0226.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de038, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de038) returned 0x0 [0226.537] WbemDefPath:IUnknown:AddRef (This=0x6de038) returned 0x3 [0226.537] WbemDefPath:IUnknown:Release (This=0x6de038) returned 0x2 [0226.537] WbemDefPath:IWbemPath:SetText (This=0x6de038, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.537] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.537] IWbemClassObject:Get (in: This=0x6d8b40, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dc3c*=0, plFlavor=0x229dc40*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x229dc3c*=19, plFlavor=0x229dc40*=0) returned 0x0 [0226.537] IWbemClassObject:Get (in: This=0x6d8b40, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dc3c*=19, plFlavor=0x229dc40*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x229dc3c*=19, plFlavor=0x229dc40*=0) returned 0x0 [0226.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.538] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.538] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.538] IWbemClassObject:Get (in: This=0x6d8b40, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dd40*=0, plFlavor=0x229dd44*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x229dd40*=8, plFlavor=0x229dd44*=0) returned 0x0 [0226.538] SysStringByteLen (bstr="fling.exe") returned 0x12 [0226.538] SysStringByteLen (bstr="fling.exe") returned 0x12 [0226.538] IWbemClassObject:Get (in: This=0x6d8b40, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229dd40*=8, plFlavor=0x229dd44*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x229dd40*=8, plFlavor=0x229dd44*=0) returned 0x0 [0226.538] SysStringByteLen (bstr="fling.exe") returned 0x12 [0226.538] SysStringByteLen (bstr="fling.exe") returned 0x12 [0226.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0226.538] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0226.539] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0226.539] IWbemClassObject:Get (in: This=0x6d8b40, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229de74*=0, plFlavor=0x229de78*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\fling.exe\" ", varVal2=0x0), pType=0x229de74*=8, plFlavor=0x229de78*=0) returned 0x0 [0226.539] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0226.539] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0226.539] IWbemClassObject:Get (in: This=0x6d8b40, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229de74*=8, plFlavor=0x229de78*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\fling.exe\" ", varVal2=0x0), pType=0x229de74*=8, plFlavor=0x229de78*=0) returned 0x0 [0226.539] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0226.539] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0226.540] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0226.540] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d8cd8, puReturned=0x227e9dc*=0x1) returned 0x0 [0227.835] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d8cd8) returned 0x0 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0227.836] IUnknown:AddRef (This=0x6d8cd8) returned 0x3 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0227.836] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d8cdc) returned 0x0 [0227.836] IMarshal:GetUnmarshalClass (in: This=0x6d8cdc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0227.836] IUnknown:Release (This=0x6d8cdc) returned 0x3 [0227.836] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0227.837] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0227.837] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0227.837] IUnknown:Release (This=0x6d8cd8) returned 0x2 [0227.837] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0227.837] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0227.837] IUnknown:QueryInterface (in: This=0x6d8cd8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d8cd8) returned 0x0 [0227.837] IUnknown:AddRef (This=0x6d8cd8) returned 0x4 [0227.837] IUnknown:Release (This=0x6d8cd8) returned 0x3 [0227.837] IUnknown:Release (This=0x6d8cd8) returned 0x2 [0227.837] CoTaskMemFree (pv=0x6a3eb8) [0227.837] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0227.838] IUnknown:AddRef (This=0x6d8cd8) returned 0x3 [0227.838] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0227.838] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0227.838] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0227.838] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0227.838] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0227.839] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0227.839] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0227.839] IUnknown:Release (This=0x692bc4) returned 0x1 [0227.840] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0227.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0227.841] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddee8) returned 0x0 [0227.841] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0227.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddee8) returned 0x0 [0227.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0227.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0227.841] WbemDefPath:IUnknown:AddRef (This=0x6ddee8) returned 0x3 [0227.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0227.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0227.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e0100) returned 0x0 [0227.842] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e0100, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0227.842] WbemDefPath:IUnknown:Release (This=0x6e0100) returned 0x3 [0227.842] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0227.842] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0227.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0227.842] WbemDefPath:IUnknown:Release (This=0x6ddee8) returned 0x2 [0227.842] WbemDefPath:IUnknown:Release (This=0x6ddee8) returned 0x1 [0227.842] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0227.842] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0227.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddee8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddee8) returned 0x0 [0227.843] WbemDefPath:IUnknown:AddRef (This=0x6ddee8) returned 0x3 [0227.843] WbemDefPath:IUnknown:Release (This=0x6ddee8) returned 0x2 [0227.843] WbemDefPath:IWbemPath:SetText (This=0x6ddee8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x0 [0227.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0227.843] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0227.843] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.844] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e864*=0, plFlavor=0x229e868*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x229e864*=19, plFlavor=0x229e868*=0) returned 0x0 [0227.844] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e864*=19, plFlavor=0x229e868*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x229e864*=19, plFlavor=0x229e868*=0) returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.845] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e968*=0, plFlavor=0x229e96c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x229e968*=8, plFlavor=0x229e96c*=0) returned 0x0 [0227.845] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0227.845] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0227.845] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229e968*=8, plFlavor=0x229e96c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x229e968*=8, plFlavor=0x229e96c*=0) returned 0x0 [0227.845] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0227.845] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0227.845] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.845] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.846] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.846] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229eac4*=0, plFlavor=0x229eac8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x229eac4*=8, plFlavor=0x229eac8*=0) returned 0x0 [0227.846] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0227.846] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0227.846] IWbemClassObject:Get (in: This=0x6d8cd8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229eac4*=8, plFlavor=0x229eac8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x229eac4*=8, plFlavor=0x229eac8*=0) returned 0x0 [0227.846] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0227.846] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0227.846] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0227.847] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d9008, puReturned=0x227e9dc*=0x1) returned 0x0 [0227.849] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d9008) returned 0x0 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0227.850] IUnknown:AddRef (This=0x6d9008) returned 0x3 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0227.850] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d900c) returned 0x0 [0227.850] IMarshal:GetUnmarshalClass (in: This=0x6d900c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0227.850] IUnknown:Release (This=0x6d900c) returned 0x3 [0227.850] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0227.851] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0227.851] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0227.851] IUnknown:Release (This=0x6d9008) returned 0x2 [0227.851] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0227.851] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0227.851] IUnknown:QueryInterface (in: This=0x6d9008, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d9008) returned 0x0 [0227.851] IUnknown:AddRef (This=0x6d9008) returned 0x4 [0227.851] IUnknown:Release (This=0x6d9008) returned 0x3 [0227.851] IUnknown:Release (This=0x6d9008) returned 0x2 [0227.851] CoTaskMemFree (pv=0x6a3eb8) [0227.851] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0227.851] IUnknown:AddRef (This=0x6d9008) returned 0x3 [0227.852] IWbemClassObject:Get (in: This=0x6d9008, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0227.852] IWbemClassObject:Get (in: This=0x6d9008, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0227.852] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0227.852] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0227.852] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0227.852] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0227.852] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0227.853] IUnknown:Release (This=0x692bc4) returned 0x1 [0227.854] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0227.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0227.854] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddc48) returned 0x0 [0227.854] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0227.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddc48) returned 0x0 [0227.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0227.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0227.855] WbemDefPath:IUnknown:AddRef (This=0x6ddc48) returned 0x3 [0227.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0227.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0227.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6df338) returned 0x0 [0227.855] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6df338, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0227.855] WbemDefPath:IUnknown:Release (This=0x6df338) returned 0x3 [0227.855] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0227.855] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0227.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0227.856] WbemDefPath:IUnknown:Release (This=0x6ddc48) returned 0x2 [0227.856] WbemDefPath:IUnknown:Release (This=0x6ddc48) returned 0x1 [0227.856] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0227.856] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0227.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddc48, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddc48) returned 0x0 [0227.856] WbemDefPath:IUnknown:AddRef (This=0x6ddc48) returned 0x3 [0227.856] WbemDefPath:IUnknown:Release (This=0x6ddc48) returned 0x2 [0227.856] WbemDefPath:IWbemPath:SetText (This=0x6ddc48, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.856] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.857] IWbemClassObject:Get (in: This=0x6d9008, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f548*=0, plFlavor=0x229f54c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x229f548*=19, plFlavor=0x229f54c*=0) returned 0x0 [0227.857] IWbemClassObject:Get (in: This=0x6d9008, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f548*=19, plFlavor=0x229f54c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x229f548*=19, plFlavor=0x229f54c*=0) returned 0x0 [0227.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.857] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.857] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.857] IWbemClassObject:Get (in: This=0x6d9008, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f64c*=0, plFlavor=0x229f650*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x229f64c*=8, plFlavor=0x229f650*=0) returned 0x0 [0227.857] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0227.858] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0227.858] IWbemClassObject:Get (in: This=0x6d9008, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f64c*=8, plFlavor=0x229f650*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x229f64c*=8, plFlavor=0x229f650*=0) returned 0x0 [0227.858] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0227.858] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0227.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.858] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.858] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.858] IWbemClassObject:Get (in: This=0x6d9008, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f7b0*=0, plFlavor=0x229f7b4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x229f7b0*=8, plFlavor=0x229f7b4*=0) returned 0x0 [0227.858] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0227.859] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0227.859] IWbemClassObject:Get (in: This=0x6d9008, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x229f7b0*=8, plFlavor=0x229f7b4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x229f7b0*=8, plFlavor=0x229f7b4*=0) returned 0x0 [0227.859] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0227.859] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0227.859] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0227.859] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d91a0, puReturned=0x227e9dc*=0x1) returned 0x0 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d91a0) returned 0x0 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0227.863] IUnknown:AddRef (This=0x6d91a0) returned 0x3 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0227.863] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d91a4) returned 0x0 [0227.864] IMarshal:GetUnmarshalClass (in: This=0x6d91a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0227.864] IUnknown:Release (This=0x6d91a4) returned 0x3 [0227.864] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0227.864] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0227.864] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0227.864] IUnknown:Release (This=0x6d91a0) returned 0x2 [0227.864] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0227.864] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0227.864] IUnknown:QueryInterface (in: This=0x6d91a0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d91a0) returned 0x0 [0227.864] IUnknown:AddRef (This=0x6d91a0) returned 0x4 [0227.864] IUnknown:Release (This=0x6d91a0) returned 0x3 [0227.864] IUnknown:Release (This=0x6d91a0) returned 0x2 [0227.864] CoTaskMemFree (pv=0x6a3eb8) [0227.865] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0227.865] IUnknown:AddRef (This=0x6d91a0) returned 0x3 [0227.865] IWbemClassObject:Get (in: This=0x6d91a0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0227.865] IWbemClassObject:Get (in: This=0x6d91a0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0227.865] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0227.865] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0227.865] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0227.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0227.866] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0227.866] IUnknown:Release (This=0x692bc4) returned 0x1 [0227.867] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0227.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0227.867] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd778) returned 0x0 [0227.867] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0227.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd778) returned 0x0 [0227.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0227.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0227.868] WbemDefPath:IUnknown:AddRef (This=0x6dd778) returned 0x3 [0227.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0227.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0227.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6df740) returned 0x0 [0227.868] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6df740, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0227.868] WbemDefPath:IUnknown:Release (This=0x6df740) returned 0x3 [0227.868] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0227.869] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0227.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0227.869] WbemDefPath:IUnknown:Release (This=0x6dd778) returned 0x2 [0227.869] WbemDefPath:IUnknown:Release (This=0x6dd778) returned 0x1 [0227.869] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0227.869] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0227.869] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd778, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd778) returned 0x0 [0227.869] WbemDefPath:IUnknown:AddRef (This=0x6dd778) returned 0x3 [0227.869] WbemDefPath:IUnknown:Release (This=0x6dd778) returned 0x2 [0227.869] WbemDefPath:IWbemPath:SetText (This=0x6dd778, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x0 [0227.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0227.869] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.870] IWbemClassObject:Get (in: This=0x6d91a0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0224*=0, plFlavor=0x22a0228*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x22a0224*=19, plFlavor=0x22a0228*=0) returned 0x0 [0227.870] IWbemClassObject:Get (in: This=0x6d91a0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0224*=19, plFlavor=0x22a0228*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x22a0224*=19, plFlavor=0x22a0228*=0) returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.870] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.871] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.871] IWbemClassObject:Get (in: This=0x6d91a0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0328*=0, plFlavor=0x22a032c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x22a0328*=8, plFlavor=0x22a032c*=0) returned 0x0 [0227.871] SysStringByteLen (bstr="icq.exe") returned 0xe [0227.871] SysStringByteLen (bstr="icq.exe") returned 0xe [0227.871] IWbemClassObject:Get (in: This=0x6d91a0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0328*=8, plFlavor=0x22a032c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x22a0328*=8, plFlavor=0x22a032c*=0) returned 0x0 [0227.871] SysStringByteLen (bstr="icq.exe") returned 0xe [0227.871] SysStringByteLen (bstr="icq.exe") returned 0xe [0227.872] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.872] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.872] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.872] IWbemClassObject:Get (in: This=0x6d91a0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0454*=0, plFlavor=0x22a0458*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ", varVal2=0x0), pType=0x22a0454*=8, plFlavor=0x22a0458*=0) returned 0x0 [0227.872] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0227.872] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0227.872] IWbemClassObject:Get (in: This=0x6d91a0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0454*=8, plFlavor=0x22a0458*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ", varVal2=0x0), pType=0x22a0454*=8, plFlavor=0x22a0458*=0) returned 0x0 [0227.872] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0227.872] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0227.873] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0227.873] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6d94d0, puReturned=0x227e9dc*=0x1) returned 0x0 [0227.931] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6d94d0) returned 0x0 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0227.932] IUnknown:AddRef (This=0x6d94d0) returned 0x3 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0227.932] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6d94d4) returned 0x0 [0227.933] IMarshal:GetUnmarshalClass (in: This=0x6d94d4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0227.933] IUnknown:Release (This=0x6d94d4) returned 0x3 [0227.933] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0227.933] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0227.933] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0227.933] IUnknown:Release (This=0x6d94d0) returned 0x2 [0227.933] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0227.933] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0227.933] IUnknown:QueryInterface (in: This=0x6d94d0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6d94d0) returned 0x0 [0227.933] IUnknown:AddRef (This=0x6d94d0) returned 0x4 [0227.933] IUnknown:Release (This=0x6d94d0) returned 0x3 [0227.933] IUnknown:Release (This=0x6d94d0) returned 0x2 [0227.934] CoTaskMemFree (pv=0x6a3eb8) [0227.934] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0227.934] IUnknown:AddRef (This=0x6d94d0) returned 0x3 [0227.934] IWbemClassObject:Get (in: This=0x6d94d0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0227.934] IWbemClassObject:Get (in: This=0x6d94d0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0227.934] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0227.934] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0227.935] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0227.935] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0227.935] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0227.935] IUnknown:Release (This=0x692bc4) returned 0x1 [0227.936] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0227.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0227.937] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd9a8) returned 0x0 [0227.937] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0227.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd9a8) returned 0x0 [0227.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0227.937] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0227.938] WbemDefPath:IUnknown:AddRef (This=0x6dd9a8) returned 0x3 [0227.938] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0227.938] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0227.938] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6df500) returned 0x0 [0227.938] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6df500, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0227.938] WbemDefPath:IUnknown:Release (This=0x6df500) returned 0x3 [0227.938] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0227.938] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0227.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0227.939] WbemDefPath:IUnknown:Release (This=0x6dd9a8) returned 0x2 [0227.939] WbemDefPath:IUnknown:Release (This=0x6dd9a8) returned 0x1 [0227.939] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0227.939] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0227.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd9a8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd9a8) returned 0x0 [0227.939] WbemDefPath:IUnknown:AddRef (This=0x6dd9a8) returned 0x3 [0227.939] WbemDefPath:IUnknown:Release (This=0x6dd9a8) returned 0x2 [0227.939] WbemDefPath:IWbemPath:SetText (This=0x6dd9a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.940] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.941] IWbemClassObject:Get (in: This=0x6d94d0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0ea0*=0, plFlavor=0x22a0ea4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe88, varVal2=0x0), pType=0x22a0ea0*=19, plFlavor=0x22a0ea4*=0) returned 0x0 [0227.941] IWbemClassObject:Get (in: This=0x6d94d0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0ea0*=19, plFlavor=0x22a0ea4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe88, varVal2=0x0), pType=0x22a0ea0*=19, plFlavor=0x22a0ea4*=0) returned 0x0 [0227.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.941] IWbemClassObject:Get (in: This=0x6d94d0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0fa4*=0, plFlavor=0x22a0fa8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x22a0fa4*=8, plFlavor=0x22a0fa8*=0) returned 0x0 [0227.941] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0227.942] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0227.942] IWbemClassObject:Get (in: This=0x6d94d0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a0fa4*=8, plFlavor=0x22a0fa8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x22a0fa4*=8, plFlavor=0x22a0fa8*=0) returned 0x0 [0227.942] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0227.942] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0227.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.942] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.942] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.942] IWbemClassObject:Get (in: This=0x6d94d0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a10e8*=0, plFlavor=0x22a10ec*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ", varVal2=0x0), pType=0x22a10e8*=8, plFlavor=0x22a10ec*=0) returned 0x0 [0227.943] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0227.943] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0227.943] IWbemClassObject:Get (in: This=0x6d94d0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a10e8*=8, plFlavor=0x22a10ec*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ", varVal2=0x0), pType=0x22a10e8*=8, plFlavor=0x22a10ec*=0) returned 0x0 [0227.943] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0227.943] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0227.943] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0227.943] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e8250, puReturned=0x227e9dc*=0x1) returned 0x0 [0227.948] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e8250) returned 0x0 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0227.949] IUnknown:AddRef (This=0x6e8250) returned 0x3 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0227.949] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e8254) returned 0x0 [0227.950] IMarshal:GetUnmarshalClass (in: This=0x6e8254, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0227.950] IUnknown:Release (This=0x6e8254) returned 0x3 [0227.950] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0227.950] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0227.950] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0227.950] IUnknown:Release (This=0x6e8250) returned 0x2 [0227.950] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0227.950] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0227.950] IUnknown:QueryInterface (in: This=0x6e8250, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e8250) returned 0x0 [0227.951] IUnknown:AddRef (This=0x6e8250) returned 0x4 [0227.951] IUnknown:Release (This=0x6e8250) returned 0x3 [0227.951] IUnknown:Release (This=0x6e8250) returned 0x2 [0227.951] CoTaskMemFree (pv=0x6a3eb8) [0227.951] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0227.951] IUnknown:AddRef (This=0x6e8250) returned 0x3 [0227.951] IWbemClassObject:Get (in: This=0x6e8250, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0227.951] IWbemClassObject:Get (in: This=0x6e8250, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0227.952] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0227.952] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0227.952] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0227.952] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0227.952] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0227.952] IUnknown:Release (This=0x692bc4) returned 0x1 [0227.954] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0227.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0227.954] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de118) returned 0x0 [0227.954] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0227.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de118) returned 0x0 [0227.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0227.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0227.955] WbemDefPath:IUnknown:AddRef (This=0x6de118) returned 0x3 [0227.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0227.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0227.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e5dd8) returned 0x0 [0227.955] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e5dd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0227.955] WbemDefPath:IUnknown:Release (This=0x6e5dd8) returned 0x3 [0227.955] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0227.955] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0227.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0227.956] WbemDefPath:IUnknown:Release (This=0x6de118) returned 0x2 [0227.956] WbemDefPath:IUnknown:Release (This=0x6de118) returned 0x1 [0227.956] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0227.956] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0227.956] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de118, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de118) returned 0x0 [0227.956] WbemDefPath:IUnknown:AddRef (This=0x6de118) returned 0x3 [0227.956] WbemDefPath:IUnknown:Release (This=0x6de118) returned 0x2 [0227.956] WbemDefPath:IWbemPath:SetText (This=0x6de118, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x0 [0227.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0227.957] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0227.957] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.957] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.957] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.957] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.957] IWbemClassObject:Get (in: This=0x6e8250, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1b4c*=0, plFlavor=0x22a1b50*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe94, varVal2=0x0), pType=0x22a1b4c*=19, plFlavor=0x22a1b50*=0) returned 0x0 [0227.957] IWbemClassObject:Get (in: This=0x6e8250, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1b4c*=19, plFlavor=0x22a1b50*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe94, varVal2=0x0), pType=0x22a1b4c*=19, plFlavor=0x22a1b50*=0) returned 0x0 [0227.958] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.958] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.958] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.958] IWbemClassObject:Get (in: This=0x6e8250, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1c50*=0, plFlavor=0x22a1c54*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x22a1c50*=8, plFlavor=0x22a1c54*=0) returned 0x0 [0227.958] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0227.958] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0227.958] IWbemClassObject:Get (in: This=0x6e8250, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1c50*=8, plFlavor=0x22a1c54*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x22a1c50*=8, plFlavor=0x22a1c54*=0) returned 0x0 [0227.958] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0227.958] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0227.959] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0227.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0227.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0227.960] IWbemClassObject:Get (in: This=0x6e8250, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1d84*=0, plFlavor=0x22a1d88*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x22a1d84*=8, plFlavor=0x22a1d88*=0) returned 0x0 [0227.960] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0227.960] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0227.960] IWbemClassObject:Get (in: This=0x6e8250, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a1d84*=8, plFlavor=0x22a1d88*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x22a1d84*=8, plFlavor=0x22a1d88*=0) returned 0x0 [0227.961] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0227.961] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0227.961] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0227.961] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7f20, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.020] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7f20) returned 0x0 [0228.020] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.020] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.020] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.021] IUnknown:AddRef (This=0x6e7f20) returned 0x3 [0228.021] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.021] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.021] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7f24) returned 0x0 [0228.021] IMarshal:GetUnmarshalClass (in: This=0x6e7f24, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.021] IUnknown:Release (This=0x6e7f24) returned 0x3 [0228.021] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.021] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.022] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.022] IUnknown:Release (This=0x6e7f20) returned 0x2 [0228.022] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.022] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.022] IUnknown:QueryInterface (in: This=0x6e7f20, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7f20) returned 0x0 [0228.022] IUnknown:AddRef (This=0x6e7f20) returned 0x4 [0228.022] IUnknown:Release (This=0x6e7f20) returned 0x3 [0228.022] IUnknown:Release (This=0x6e7f20) returned 0x2 [0228.022] CoTaskMemFree (pv=0x6a3eb8) [0228.022] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.022] IUnknown:AddRef (This=0x6e7f20) returned 0x3 [0228.022] IWbemClassObject:Get (in: This=0x6e7f20, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.024] IWbemClassObject:Get (in: This=0x6e7f20, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.024] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0228.024] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0228.024] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.024] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.024] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.024] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.026] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.026] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd7e8) returned 0x0 [0228.026] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.026] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd7e8) returned 0x0 [0228.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.027] WbemDefPath:IUnknown:AddRef (This=0x6dd7e8) returned 0x3 [0228.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e5c40) returned 0x0 [0228.027] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e5c40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.027] WbemDefPath:IUnknown:Release (This=0x6e5c40) returned 0x3 [0228.027] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.028] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.028] WbemDefPath:IUnknown:Release (This=0x6dd7e8) returned 0x2 [0228.028] WbemDefPath:IUnknown:Release (This=0x6dd7e8) returned 0x1 [0228.028] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.028] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd7e8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd7e8) returned 0x0 [0228.028] WbemDefPath:IUnknown:AddRef (This=0x6dd7e8) returned 0x3 [0228.028] WbemDefPath:IUnknown:Release (This=0x6dd7e8) returned 0x2 [0228.028] WbemDefPath:IWbemPath:SetText (This=0x6dd7e8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x0 [0228.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.028] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.028] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.028] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.029] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.029] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.029] IWbemClassObject:Get (in: This=0x6e7f20, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a27d4*=0, plFlavor=0x22a27d8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe9c, varVal2=0x0), pType=0x22a27d4*=19, plFlavor=0x22a27d8*=0) returned 0x0 [0228.029] IWbemClassObject:Get (in: This=0x6e7f20, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a27d4*=19, plFlavor=0x22a27d8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe9c, varVal2=0x0), pType=0x22a27d4*=19, plFlavor=0x22a27d8*=0) returned 0x0 [0228.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.029] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.029] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.029] IWbemClassObject:Get (in: This=0x6e7f20, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a28d8*=0, plFlavor=0x22a28dc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x22a28d8*=8, plFlavor=0x22a28dc*=0) returned 0x0 [0228.030] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0228.030] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0228.030] IWbemClassObject:Get (in: This=0x6e7f20, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a28d8*=8, plFlavor=0x22a28dc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x22a28d8*=8, plFlavor=0x22a28dc*=0) returned 0x0 [0228.030] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0228.030] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0228.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.030] IWbemClassObject:Get (in: This=0x6e7f20, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a2a14*=0, plFlavor=0x22a2a18*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ", varVal2=0x0), pType=0x22a2a14*=8, plFlavor=0x22a2a18*=0) returned 0x0 [0228.031] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0228.031] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0228.031] IWbemClassObject:Get (in: This=0x6e7f20, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a2a14*=8, plFlavor=0x22a2a18*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ", varVal2=0x0), pType=0x22a2a14*=8, plFlavor=0x22a2a18*=0) returned 0x0 [0228.031] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0228.031] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0228.031] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.031] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e6738, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.035] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e6738) returned 0x0 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.036] IUnknown:AddRef (This=0x6e6738) returned 0x3 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.036] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e673c) returned 0x0 [0228.036] IMarshal:GetUnmarshalClass (in: This=0x6e673c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.036] IUnknown:Release (This=0x6e673c) returned 0x3 [0228.036] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.037] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.037] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.037] IUnknown:Release (This=0x6e6738) returned 0x2 [0228.037] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.037] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.037] IUnknown:QueryInterface (in: This=0x6e6738, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e6738) returned 0x0 [0228.037] IUnknown:AddRef (This=0x6e6738) returned 0x4 [0228.037] IUnknown:Release (This=0x6e6738) returned 0x3 [0228.037] IUnknown:Release (This=0x6e6738) returned 0x2 [0228.037] CoTaskMemFree (pv=0x6a3eb8) [0228.037] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.037] IUnknown:AddRef (This=0x6e6738) returned 0x3 [0228.038] IWbemClassObject:Get (in: This=0x6e6738, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.038] IWbemClassObject:Get (in: This=0x6e6738, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.038] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0228.038] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0228.038] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.038] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.038] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.039] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.040] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0228.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.040] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de188) returned 0x0 [0228.040] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0228.040] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de188) returned 0x0 [0228.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.041] WbemDefPath:IUnknown:AddRef (This=0x6de188) returned 0x3 [0228.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e6018) returned 0x0 [0228.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e6018, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.042] WbemDefPath:IUnknown:Release (This=0x6e6018) returned 0x3 [0228.042] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.042] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.042] WbemDefPath:IUnknown:Release (This=0x6de188) returned 0x2 [0228.042] WbemDefPath:IUnknown:Release (This=0x6de188) returned 0x1 [0228.042] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.042] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de188, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de188) returned 0x0 [0228.042] WbemDefPath:IUnknown:AddRef (This=0x6de188) returned 0x3 [0228.042] WbemDefPath:IUnknown:Release (This=0x6de188) returned 0x2 [0228.042] WbemDefPath:IWbemPath:SetText (This=0x6de188, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.043] IWbemClassObject:Get (in: This=0x6e6738, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3498*=0, plFlavor=0x22a349c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x22a3498*=19, plFlavor=0x22a349c*=0) returned 0x0 [0228.043] IWbemClassObject:Get (in: This=0x6e6738, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a3498*=19, plFlavor=0x22a349c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x22a3498*=19, plFlavor=0x22a349c*=0) returned 0x0 [0228.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.044] IWbemClassObject:Get (in: This=0x6e6738, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a359c*=0, plFlavor=0x22a35a0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x22a359c*=8, plFlavor=0x22a35a0*=0) returned 0x0 [0228.044] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0228.044] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0228.044] IWbemClassObject:Get (in: This=0x6e6738, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a359c*=8, plFlavor=0x22a35a0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x22a359c*=8, plFlavor=0x22a35a0*=0) returned 0x0 [0228.044] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0228.044] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0228.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.045] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.045] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.045] IWbemClassObject:Get (in: This=0x6e6738, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a36e0*=0, plFlavor=0x22a36e4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ", varVal2=0x0), pType=0x22a36e0*=8, plFlavor=0x22a36e4*=0) returned 0x0 [0228.045] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0228.045] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0228.045] IWbemClassObject:Get (in: This=0x6e6738, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a36e0*=8, plFlavor=0x22a36e4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ", varVal2=0x0), pType=0x22a36e0*=8, plFlavor=0x22a36e4*=0) returned 0x0 [0228.045] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0228.045] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0228.046] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.046] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e70c8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.048] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e70c8) returned 0x0 [0228.048] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.048] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.049] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.049] IUnknown:AddRef (This=0x6e70c8) returned 0x3 [0228.049] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.049] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.049] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e70cc) returned 0x0 [0228.049] IMarshal:GetUnmarshalClass (in: This=0x6e70cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.049] IUnknown:Release (This=0x6e70cc) returned 0x3 [0228.049] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.050] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.050] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.050] IUnknown:Release (This=0x6e70c8) returned 0x2 [0228.050] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.050] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.050] IUnknown:QueryInterface (in: This=0x6e70c8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e70c8) returned 0x0 [0228.050] IUnknown:AddRef (This=0x6e70c8) returned 0x4 [0228.050] IUnknown:Release (This=0x6e70c8) returned 0x3 [0228.050] IUnknown:Release (This=0x6e70c8) returned 0x2 [0228.050] CoTaskMemFree (pv=0x6a3eb8) [0228.050] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.050] IUnknown:AddRef (This=0x6e70c8) returned 0x3 [0228.050] IWbemClassObject:Get (in: This=0x6e70c8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.051] IWbemClassObject:Get (in: This=0x6e70c8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.051] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0228.051] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0228.051] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.051] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.051] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.051] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.053] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.053] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd468) returned 0x0 [0228.053] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd468) returned 0x0 [0228.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.054] WbemDefPath:IUnknown:AddRef (This=0x6dd468) returned 0x3 [0228.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e6120) returned 0x0 [0228.054] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e6120, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.054] WbemDefPath:IUnknown:Release (This=0x6e6120) returned 0x3 [0228.054] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.054] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.055] WbemDefPath:IUnknown:Release (This=0x6dd468) returned 0x2 [0228.055] WbemDefPath:IUnknown:Release (This=0x6dd468) returned 0x1 [0228.055] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.055] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd468, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd468) returned 0x0 [0228.055] WbemDefPath:IUnknown:AddRef (This=0x6dd468) returned 0x3 [0228.055] WbemDefPath:IUnknown:Release (This=0x6dd468) returned 0x2 [0228.055] WbemDefPath:IWbemPath:SetText (This=0x6dd468, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.056] IWbemClassObject:Get (in: This=0x6e70c8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4138*=0, plFlavor=0x22a413c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeb4, varVal2=0x0), pType=0x22a4138*=19, plFlavor=0x22a413c*=0) returned 0x0 [0228.057] IWbemClassObject:Get (in: This=0x6e70c8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4138*=19, plFlavor=0x22a413c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeb4, varVal2=0x0), pType=0x22a4138*=19, plFlavor=0x22a413c*=0) returned 0x0 [0228.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.057] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.057] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.057] IWbemClassObject:Get (in: This=0x6e70c8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a423c*=0, plFlavor=0x22a4240*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x22a423c*=8, plFlavor=0x22a4240*=0) returned 0x0 [0228.057] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0228.057] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0228.057] IWbemClassObject:Get (in: This=0x6e70c8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a423c*=8, plFlavor=0x22a4240*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x22a423c*=8, plFlavor=0x22a4240*=0) returned 0x0 [0228.058] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0228.058] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0228.058] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.058] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.058] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.058] IWbemClassObject:Get (in: This=0x6e70c8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4378*=0, plFlavor=0x22a437c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x22a4378*=8, plFlavor=0x22a437c*=0) returned 0x0 [0228.058] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0228.058] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0228.058] IWbemClassObject:Get (in: This=0x6e70c8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4378*=8, plFlavor=0x22a437c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x22a4378*=8, plFlavor=0x22a437c*=0) returned 0x0 [0228.059] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0228.059] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0228.059] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.059] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e73f8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.115] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e73f8) returned 0x0 [0228.115] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.116] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.116] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.116] IUnknown:AddRef (This=0x6e73f8) returned 0x3 [0228.116] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.116] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.116] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e73fc) returned 0x0 [0228.116] IMarshal:GetUnmarshalClass (in: This=0x6e73fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.116] IUnknown:Release (This=0x6e73fc) returned 0x3 [0228.117] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.117] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.117] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.117] IUnknown:Release (This=0x6e73f8) returned 0x2 [0228.117] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.117] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.117] IUnknown:QueryInterface (in: This=0x6e73f8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e73f8) returned 0x0 [0228.117] IUnknown:AddRef (This=0x6e73f8) returned 0x4 [0228.117] IUnknown:Release (This=0x6e73f8) returned 0x3 [0228.117] IUnknown:Release (This=0x6e73f8) returned 0x2 [0228.117] CoTaskMemFree (pv=0x6a3eb8) [0228.118] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.118] IUnknown:AddRef (This=0x6e73f8) returned 0x3 [0228.118] IWbemClassObject:Get (in: This=0x6e73f8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.118] IWbemClassObject:Get (in: This=0x6e73f8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.118] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0228.118] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0228.118] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.119] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.119] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.119] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.120] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0228.120] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.120] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddd28) returned 0x0 [0228.120] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddd28) returned 0x0 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.121] WbemDefPath:IUnknown:AddRef (This=0x6ddd28) returned 0x3 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e6300) returned 0x0 [0228.121] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e6300, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.122] WbemDefPath:IUnknown:Release (This=0x6e6300) returned 0x3 [0228.122] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.122] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.122] WbemDefPath:IUnknown:Release (This=0x6ddd28) returned 0x2 [0228.122] WbemDefPath:IUnknown:Release (This=0x6ddd28) returned 0x1 [0228.122] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.122] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd28, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddd28) returned 0x0 [0228.122] WbemDefPath:IUnknown:AddRef (This=0x6ddd28) returned 0x3 [0228.122] WbemDefPath:IUnknown:Release (This=0x6ddd28) returned 0x2 [0228.123] WbemDefPath:IWbemPath:SetText (This=0x6ddd28, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.123] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.123] IWbemClassObject:Get (in: This=0x6e73f8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4db4*=0, plFlavor=0x22a4db8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec0, varVal2=0x0), pType=0x22a4db4*=19, plFlavor=0x22a4db8*=0) returned 0x0 [0228.123] IWbemClassObject:Get (in: This=0x6e73f8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4db4*=19, plFlavor=0x22a4db8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec0, varVal2=0x0), pType=0x22a4db4*=19, plFlavor=0x22a4db8*=0) returned 0x0 [0228.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.124] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.124] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.124] IWbemClassObject:Get (in: This=0x6e73f8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4eb8*=0, plFlavor=0x22a4ebc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x22a4eb8*=8, plFlavor=0x22a4ebc*=0) returned 0x0 [0228.124] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0228.124] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0228.125] IWbemClassObject:Get (in: This=0x6e73f8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4eb8*=8, plFlavor=0x22a4ebc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x22a4eb8*=8, plFlavor=0x22a4ebc*=0) returned 0x0 [0228.125] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0228.125] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0228.125] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.125] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.125] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.125] IWbemClassObject:Get (in: This=0x6e73f8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4ff4*=0, plFlavor=0x22a4ff8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ", varVal2=0x0), pType=0x22a4ff4*=8, plFlavor=0x22a4ff8*=0) returned 0x0 [0228.126] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0228.126] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0228.126] IWbemClassObject:Get (in: This=0x6e73f8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a4ff4*=8, plFlavor=0x22a4ff8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ", varVal2=0x0), pType=0x22a4ff4*=8, plFlavor=0x22a4ff8*=0) returned 0x0 [0228.126] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0228.126] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0228.126] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.130] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7728, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.143] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7728) returned 0x0 [0228.143] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.143] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.144] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.144] IUnknown:AddRef (This=0x6e7728) returned 0x3 [0228.144] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.144] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.144] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e772c) returned 0x0 [0228.144] IMarshal:GetUnmarshalClass (in: This=0x6e772c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.144] IUnknown:Release (This=0x6e772c) returned 0x3 [0228.144] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.145] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.145] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.145] IUnknown:Release (This=0x6e7728) returned 0x2 [0228.145] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.145] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.145] IUnknown:QueryInterface (in: This=0x6e7728, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7728) returned 0x0 [0228.145] IUnknown:AddRef (This=0x6e7728) returned 0x4 [0228.145] IUnknown:Release (This=0x6e7728) returned 0x3 [0228.145] IUnknown:Release (This=0x6e7728) returned 0x2 [0228.145] CoTaskMemFree (pv=0x6a3eb8) [0228.145] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.146] IUnknown:AddRef (This=0x6e7728) returned 0x3 [0228.146] IWbemClassObject:Get (in: This=0x6e7728, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.146] IWbemClassObject:Get (in: This=0x6e7728, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.146] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0228.146] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0228.146] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.147] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.147] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.147] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.151] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.151] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd858) returned 0x0 [0228.151] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd858) returned 0x0 [0228.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.152] WbemDefPath:IUnknown:AddRef (This=0x6dd858) returned 0x3 [0228.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e6408) returned 0x0 [0228.152] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e6408, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.152] WbemDefPath:IUnknown:Release (This=0x6e6408) returned 0x3 [0228.152] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.152] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.152] WbemDefPath:IUnknown:Release (This=0x6dd858) returned 0x2 [0228.152] WbemDefPath:IUnknown:Release (This=0x6dd858) returned 0x1 [0228.153] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.153] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd858, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd858) returned 0x0 [0228.153] WbemDefPath:IUnknown:AddRef (This=0x6dd858) returned 0x3 [0228.153] WbemDefPath:IUnknown:Release (This=0x6dd858) returned 0x2 [0228.153] WbemDefPath:IWbemPath:SetText (This=0x6dd858, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x0 [0228.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.153] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.153] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.153] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.153] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.154] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.154] IWbemClassObject:Get (in: This=0x6e7728, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5a6c*=0, plFlavor=0x22a5a70*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x22a5a6c*=19, plFlavor=0x22a5a70*=0) returned 0x0 [0228.154] IWbemClassObject:Get (in: This=0x6e7728, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5a6c*=19, plFlavor=0x22a5a70*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x22a5a6c*=19, plFlavor=0x22a5a70*=0) returned 0x0 [0228.154] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.154] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.154] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.154] IWbemClassObject:Get (in: This=0x6e7728, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5b70*=0, plFlavor=0x22a5b74*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x22a5b70*=8, plFlavor=0x22a5b74*=0) returned 0x0 [0228.154] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0228.154] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0228.155] IWbemClassObject:Get (in: This=0x6e7728, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5b70*=8, plFlavor=0x22a5b74*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x22a5b70*=8, plFlavor=0x22a5b74*=0) returned 0x0 [0228.155] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0228.155] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0228.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.155] IWbemClassObject:Get (in: This=0x6e7728, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5cb4*=0, plFlavor=0x22a5cb8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ", varVal2=0x0), pType=0x22a5cb4*=8, plFlavor=0x22a5cb8*=0) returned 0x0 [0228.155] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0228.155] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0228.156] IWbemClassObject:Get (in: This=0x6e7728, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a5cb4*=8, plFlavor=0x22a5cb8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ", varVal2=0x0), pType=0x22a5cb4*=8, plFlavor=0x22a5cb8*=0) returned 0x0 [0228.156] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0228.156] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0228.156] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.156] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7590, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.161] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7590) returned 0x0 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.162] IUnknown:AddRef (This=0x6e7590) returned 0x3 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.162] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7594) returned 0x0 [0228.162] IMarshal:GetUnmarshalClass (in: This=0x6e7594, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.162] IUnknown:Release (This=0x6e7594) returned 0x3 [0228.163] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.163] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.163] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.163] IUnknown:Release (This=0x6e7590) returned 0x2 [0228.163] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.163] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.163] IUnknown:QueryInterface (in: This=0x6e7590, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7590) returned 0x0 [0228.163] IUnknown:AddRef (This=0x6e7590) returned 0x4 [0228.163] IUnknown:Release (This=0x6e7590) returned 0x3 [0228.163] IUnknown:Release (This=0x6e7590) returned 0x2 [0228.163] CoTaskMemFree (pv=0x6a3eb8) [0228.164] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.164] IUnknown:AddRef (This=0x6e7590) returned 0x3 [0228.164] IWbemClassObject:Get (in: This=0x6e7590, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.164] IWbemClassObject:Get (in: This=0x6e7590, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.164] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0228.165] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0228.165] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.166] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.166] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.166] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.167] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.167] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dda18) returned 0x0 [0228.168] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dda18) returned 0x0 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.168] WbemDefPath:IUnknown:AddRef (This=0x6dda18) returned 0x3 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e5880) returned 0x0 [0228.168] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e5880, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.168] WbemDefPath:IUnknown:Release (This=0x6e5880) returned 0x3 [0228.169] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.169] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.169] WbemDefPath:IUnknown:Release (This=0x6dda18) returned 0x2 [0228.169] WbemDefPath:IUnknown:Release (This=0x6dda18) returned 0x1 [0228.169] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.169] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda18, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dda18) returned 0x0 [0228.169] WbemDefPath:IUnknown:AddRef (This=0x6dda18) returned 0x3 [0228.169] WbemDefPath:IUnknown:Release (This=0x6dda18) returned 0x2 [0228.169] WbemDefPath:IWbemPath:SetText (This=0x6dda18, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.170] IWbemClassObject:Get (in: This=0x6e7590, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a676c*=0, plFlavor=0x22a6770*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x22a676c*=19, plFlavor=0x22a6770*=0) returned 0x0 [0228.170] IWbemClassObject:Get (in: This=0x6e7590, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a676c*=19, plFlavor=0x22a6770*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x22a676c*=19, plFlavor=0x22a6770*=0) returned 0x0 [0228.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.171] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.171] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.171] IWbemClassObject:Get (in: This=0x6e7590, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6870*=0, plFlavor=0x22a6874*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x22a6870*=8, plFlavor=0x22a6874*=0) returned 0x0 [0228.171] SysStringByteLen (bstr="skype.exe") returned 0x12 [0228.171] SysStringByteLen (bstr="skype.exe") returned 0x12 [0228.171] IWbemClassObject:Get (in: This=0x6e7590, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a6870*=8, plFlavor=0x22a6874*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x22a6870*=8, plFlavor=0x22a6874*=0) returned 0x0 [0228.171] SysStringByteLen (bstr="skype.exe") returned 0x12 [0228.171] SysStringByteLen (bstr="skype.exe") returned 0x12 [0228.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.171] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.172] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.172] IWbemClassObject:Get (in: This=0x6e7590, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a69a4*=0, plFlavor=0x22a69a8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ", varVal2=0x0), pType=0x22a69a4*=8, plFlavor=0x22a69a8*=0) returned 0x0 [0228.172] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0228.172] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0228.173] IWbemClassObject:Get (in: This=0x6e7590, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a69a4*=8, plFlavor=0x22a69a8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ", varVal2=0x0), pType=0x22a69a4*=8, plFlavor=0x22a69a8*=0) returned 0x0 [0228.173] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0228.173] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0228.173] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.173] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e65a0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.260] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e65a0) returned 0x0 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.261] IUnknown:AddRef (This=0x6e65a0) returned 0x3 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.261] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e65a4) returned 0x0 [0228.262] IMarshal:GetUnmarshalClass (in: This=0x6e65a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.265] IUnknown:Release (This=0x6e65a4) returned 0x3 [0228.265] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.265] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.265] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.265] IUnknown:Release (This=0x6e65a0) returned 0x2 [0228.265] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.265] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.265] IUnknown:QueryInterface (in: This=0x6e65a0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e65a0) returned 0x0 [0228.266] IUnknown:AddRef (This=0x6e65a0) returned 0x4 [0228.266] IUnknown:Release (This=0x6e65a0) returned 0x3 [0228.267] IUnknown:Release (This=0x6e65a0) returned 0x2 [0228.267] CoTaskMemFree (pv=0x6a3eb8) [0228.267] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.267] IUnknown:AddRef (This=0x6e65a0) returned 0x3 [0228.267] IWbemClassObject:Get (in: This=0x6e65a0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.267] IWbemClassObject:Get (in: This=0x6e65a0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.267] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0228.267] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0228.267] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.268] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.268] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.268] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.269] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.270] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de1f8) returned 0x0 [0228.270] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de1f8) returned 0x0 [0228.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.271] WbemDefPath:IUnknown:AddRef (This=0x6de1f8) returned 0x3 [0228.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e55e0) returned 0x0 [0228.271] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e55e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.271] WbemDefPath:IUnknown:Release (This=0x6e55e0) returned 0x3 [0228.271] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.271] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.272] WbemDefPath:IUnknown:Release (This=0x6de1f8) returned 0x2 [0228.272] WbemDefPath:IUnknown:Release (This=0x6de1f8) returned 0x1 [0228.272] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.272] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.272] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de1f8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de1f8) returned 0x0 [0228.272] WbemDefPath:IUnknown:AddRef (This=0x6de1f8) returned 0x3 [0228.272] WbemDefPath:IUnknown:Release (This=0x6de1f8) returned 0x2 [0228.272] WbemDefPath:IWbemPath:SetText (This=0x6de1f8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x0 [0228.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.272] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.272] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.272] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.273] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.273] IWbemClassObject:Get (in: This=0x6e65a0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a73f4*=0, plFlavor=0x22a73f8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x22a73f4*=19, plFlavor=0x22a73f8*=0) returned 0x0 [0228.273] IWbemClassObject:Get (in: This=0x6e65a0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a73f4*=19, plFlavor=0x22a73f8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x22a73f4*=19, plFlavor=0x22a73f8*=0) returned 0x0 [0228.273] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.273] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.273] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.273] IWbemClassObject:Get (in: This=0x6e65a0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a74f8*=0, plFlavor=0x22a74fc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x22a74f8*=8, plFlavor=0x22a74fc*=0) returned 0x0 [0228.274] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0228.274] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0228.274] IWbemClassObject:Get (in: This=0x6e65a0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a74f8*=8, plFlavor=0x22a74fc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x22a74f8*=8, plFlavor=0x22a74fc*=0) returned 0x0 [0228.274] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0228.274] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0228.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.274] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.274] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.275] IWbemClassObject:Get (in: This=0x6e65a0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a763c*=0, plFlavor=0x22a7640*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ", varVal2=0x0), pType=0x22a763c*=8, plFlavor=0x22a7640*=0) returned 0x0 [0228.275] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0228.275] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0228.275] IWbemClassObject:Get (in: This=0x6e65a0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a763c*=8, plFlavor=0x22a7640*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ", varVal2=0x0), pType=0x22a763c*=8, plFlavor=0x22a7640*=0) returned 0x0 [0228.275] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0228.275] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0228.275] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.276] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7260, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.277] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7260) returned 0x0 [0228.277] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.277] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.278] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.278] IUnknown:AddRef (This=0x6e7260) returned 0x3 [0228.278] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.278] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.278] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7264) returned 0x0 [0228.278] IMarshal:GetUnmarshalClass (in: This=0x6e7264, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.278] IUnknown:Release (This=0x6e7264) returned 0x3 [0228.278] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.278] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.278] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.279] IUnknown:Release (This=0x6e7260) returned 0x2 [0228.279] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.279] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.279] IUnknown:QueryInterface (in: This=0x6e7260, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7260) returned 0x0 [0228.279] IUnknown:AddRef (This=0x6e7260) returned 0x4 [0228.279] IUnknown:Release (This=0x6e7260) returned 0x3 [0228.279] IUnknown:Release (This=0x6e7260) returned 0x2 [0228.279] CoTaskMemFree (pv=0x6a3eb8) [0228.279] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.279] IUnknown:AddRef (This=0x6e7260) returned 0x3 [0228.279] IWbemClassObject:Get (in: This=0x6e7260, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.280] IWbemClassObject:Get (in: This=0x6e7260, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.280] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0228.280] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0228.280] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.280] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.280] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.280] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.348] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.348] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddd98) returned 0x0 [0228.348] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddd98) returned 0x0 [0228.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.349] WbemDefPath:IUnknown:AddRef (This=0x6ddd98) returned 0x3 [0228.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.349] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e5a48) returned 0x0 [0228.349] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e5a48, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.349] WbemDefPath:IUnknown:Release (This=0x6e5a48) returned 0x3 [0228.349] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.350] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.350] WbemDefPath:IUnknown:Release (This=0x6ddd98) returned 0x2 [0228.350] WbemDefPath:IUnknown:Release (This=0x6ddd98) returned 0x1 [0228.350] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.350] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddd98, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddd98) returned 0x0 [0228.350] WbemDefPath:IUnknown:AddRef (This=0x6ddd98) returned 0x3 [0228.350] WbemDefPath:IUnknown:Release (This=0x6ddd98) returned 0x2 [0228.350] WbemDefPath:IWbemPath:SetText (This=0x6ddd98, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x0 [0228.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.350] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.351] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.351] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.351] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.351] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.351] IWbemClassObject:Get (in: This=0x6e7260, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a80f0*=0, plFlavor=0x22a80f4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x22a80f0*=19, plFlavor=0x22a80f4*=0) returned 0x0 [0228.351] IWbemClassObject:Get (in: This=0x6e7260, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a80f0*=19, plFlavor=0x22a80f4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x22a80f0*=19, plFlavor=0x22a80f4*=0) returned 0x0 [0228.352] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.352] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.352] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.352] IWbemClassObject:Get (in: This=0x6e7260, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a81f4*=0, plFlavor=0x22a81f8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x22a81f4*=8, plFlavor=0x22a81f8*=0) returned 0x0 [0228.352] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0228.352] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0228.352] IWbemClassObject:Get (in: This=0x6e7260, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a81f4*=8, plFlavor=0x22a81f8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x22a81f4*=8, plFlavor=0x22a81f8*=0) returned 0x0 [0228.352] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0228.353] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0228.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.353] IWbemClassObject:Get (in: This=0x6e7260, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8340*=0, plFlavor=0x22a8344*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ", varVal2=0x0), pType=0x22a8340*=8, plFlavor=0x22a8344*=0) returned 0x0 [0228.353] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0228.353] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0228.353] IWbemClassObject:Get (in: This=0x6e7260, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8340*=8, plFlavor=0x22a8344*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ", varVal2=0x0), pType=0x22a8340*=8, plFlavor=0x22a8344*=0) returned 0x0 [0228.354] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0228.354] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0228.354] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.354] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e6a68, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.407] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e6a68) returned 0x0 [0228.408] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.408] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.408] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.412] IUnknown:AddRef (This=0x6e6a68) returned 0x3 [0228.412] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.412] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.412] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e6a6c) returned 0x0 [0228.413] IMarshal:GetUnmarshalClass (in: This=0x6e6a6c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.413] IUnknown:Release (This=0x6e6a6c) returned 0x3 [0228.413] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.413] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.413] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.413] IUnknown:Release (This=0x6e6a68) returned 0x2 [0228.413] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.413] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.414] IUnknown:QueryInterface (in: This=0x6e6a68, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e6a68) returned 0x0 [0228.414] IUnknown:AddRef (This=0x6e6a68) returned 0x4 [0228.414] IUnknown:Release (This=0x6e6a68) returned 0x3 [0228.414] IUnknown:Release (This=0x6e6a68) returned 0x2 [0228.414] CoTaskMemFree (pv=0x6a3eb8) [0228.414] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.414] IUnknown:AddRef (This=0x6e6a68) returned 0x3 [0228.414] IWbemClassObject:Get (in: This=0x6e6a68, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.414] IWbemClassObject:Get (in: This=0x6e6a68, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.415] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0228.415] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0228.415] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.415] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.415] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.415] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.417] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd4d8) returned 0x0 [0228.417] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd4d8) returned 0x0 [0228.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.418] WbemDefPath:IUnknown:AddRef (This=0x6dd4d8) returned 0x3 [0228.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6e59d0) returned 0x0 [0228.418] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6e59d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.418] WbemDefPath:IUnknown:Release (This=0x6e59d0) returned 0x3 [0228.419] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.419] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.419] WbemDefPath:IUnknown:Release (This=0x6dd4d8) returned 0x2 [0228.419] WbemDefPath:IUnknown:Release (This=0x6dd4d8) returned 0x1 [0228.419] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.419] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd4d8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd4d8) returned 0x0 [0228.419] WbemDefPath:IUnknown:AddRef (This=0x6dd4d8) returned 0x3 [0228.419] WbemDefPath:IUnknown:Release (This=0x6dd4d8) returned 0x2 [0228.419] WbemDefPath:IWbemPath:SetText (This=0x6dd4d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x0 [0228.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.420] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.420] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.420] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.421] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.421] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.421] IWbemClassObject:Get (in: This=0x6e6a68, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8dcc*=0, plFlavor=0x22a8dd0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x22a8dcc*=19, plFlavor=0x22a8dd0*=0) returned 0x0 [0228.421] IWbemClassObject:Get (in: This=0x6e6a68, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8dcc*=19, plFlavor=0x22a8dd0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x22a8dcc*=19, plFlavor=0x22a8dd0*=0) returned 0x0 [0228.421] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.421] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.421] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.421] IWbemClassObject:Get (in: This=0x6e6a68, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8ed0*=0, plFlavor=0x22a8ed4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x22a8ed0*=8, plFlavor=0x22a8ed4*=0) returned 0x0 [0228.421] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0228.421] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0228.422] IWbemClassObject:Get (in: This=0x6e6a68, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a8ed0*=8, plFlavor=0x22a8ed4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x22a8ed0*=8, plFlavor=0x22a8ed4*=0) returned 0x0 [0228.422] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0228.422] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0228.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.423] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.423] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.423] IWbemClassObject:Get (in: This=0x6e6a68, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9014*=0, plFlavor=0x22a9018*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\trillian.exe\" ", varVal2=0x0), pType=0x22a9014*=8, plFlavor=0x22a9018*=0) returned 0x0 [0228.423] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0228.423] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0228.423] IWbemClassObject:Get (in: This=0x6e6a68, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9014*=8, plFlavor=0x22a9018*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\trillian.exe\" ", varVal2=0x0), pType=0x22a9014*=8, plFlavor=0x22a9018*=0) returned 0x0 [0228.423] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0228.423] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0228.424] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.424] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e78c0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.425] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e78c0) returned 0x0 [0228.426] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.426] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.426] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.426] IUnknown:AddRef (This=0x6e78c0) returned 0x3 [0228.426] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.426] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.427] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e78c4) returned 0x0 [0228.427] IMarshal:GetUnmarshalClass (in: This=0x6e78c4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.427] IUnknown:Release (This=0x6e78c4) returned 0x3 [0228.427] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.427] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.427] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.427] IUnknown:Release (This=0x6e78c0) returned 0x2 [0228.427] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.427] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.428] IUnknown:QueryInterface (in: This=0x6e78c0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e78c0) returned 0x0 [0228.428] IUnknown:AddRef (This=0x6e78c0) returned 0x4 [0228.428] IUnknown:Release (This=0x6e78c0) returned 0x3 [0228.428] IUnknown:Release (This=0x6e78c0) returned 0x2 [0228.428] CoTaskMemFree (pv=0x6a3eb8) [0228.428] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.428] IUnknown:AddRef (This=0x6e78c0) returned 0x3 [0228.428] IWbemClassObject:Get (in: This=0x6e78c0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.428] IWbemClassObject:Get (in: This=0x6e78c0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.429] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0228.429] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0228.429] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.429] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.429] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.429] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.430] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.431] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd8c8) returned 0x0 [0228.431] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd8c8) returned 0x0 [0228.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.431] WbemDefPath:IUnknown:AddRef (This=0x6dd8c8) returned 0x3 [0228.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ecdb0) returned 0x0 [0228.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ecdb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.432] WbemDefPath:IUnknown:Release (This=0x6ecdb0) returned 0x3 [0228.432] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.432] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.432] WbemDefPath:IUnknown:Release (This=0x6dd8c8) returned 0x2 [0228.432] WbemDefPath:IUnknown:Release (This=0x6dd8c8) returned 0x1 [0228.432] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.432] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd8c8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd8c8) returned 0x0 [0228.433] WbemDefPath:IUnknown:AddRef (This=0x6dd8c8) returned 0x3 [0228.433] WbemDefPath:IUnknown:Release (This=0x6dd8c8) returned 0x2 [0228.433] WbemDefPath:IWbemPath:SetText (This=0x6dd8c8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.433] IWbemClassObject:Get (in: This=0x6e78c0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9a2c*=0, plFlavor=0x22a9a30*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x22a9a2c*=19, plFlavor=0x22a9a30*=0) returned 0x0 [0228.434] IWbemClassObject:Get (in: This=0x6e78c0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9a2c*=19, plFlavor=0x22a9a30*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x22a9a2c*=19, plFlavor=0x22a9a30*=0) returned 0x0 [0228.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.434] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.434] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.434] IWbemClassObject:Get (in: This=0x6e78c0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9b30*=0, plFlavor=0x22a9b34*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x22a9b30*=8, plFlavor=0x22a9b34*=0) returned 0x0 [0228.434] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0228.434] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0228.435] IWbemClassObject:Get (in: This=0x6e78c0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9b30*=8, plFlavor=0x22a9b34*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x22a9b30*=8, plFlavor=0x22a9b34*=0) returned 0x0 [0228.435] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0228.435] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0228.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.435] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.435] IWbemClassObject:Get (in: This=0x6e78c0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9c74*=0, plFlavor=0x22a9c78*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ", varVal2=0x0), pType=0x22a9c74*=8, plFlavor=0x22a9c78*=0) returned 0x0 [0228.435] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0228.435] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0228.436] IWbemClassObject:Get (in: This=0x6e78c0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22a9c74*=8, plFlavor=0x22a9c78*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ", varVal2=0x0), pType=0x22a9c74*=8, plFlavor=0x22a9c78*=0) returned 0x0 [0228.436] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0228.436] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0228.436] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.436] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7a58, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.438] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7a58) returned 0x0 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.439] IUnknown:AddRef (This=0x6e7a58) returned 0x3 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.439] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7a5c) returned 0x0 [0228.440] IMarshal:GetUnmarshalClass (in: This=0x6e7a5c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.440] IUnknown:Release (This=0x6e7a5c) returned 0x3 [0228.440] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.440] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.440] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.440] IUnknown:Release (This=0x6e7a58) returned 0x2 [0228.440] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.440] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.440] IUnknown:QueryInterface (in: This=0x6e7a58, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7a58) returned 0x0 [0228.440] IUnknown:AddRef (This=0x6e7a58) returned 0x4 [0228.441] IUnknown:Release (This=0x6e7a58) returned 0x3 [0228.441] IUnknown:Release (This=0x6e7a58) returned 0x2 [0228.441] CoTaskMemFree (pv=0x6a3eb8) [0228.441] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.441] IUnknown:AddRef (This=0x6e7a58) returned 0x3 [0228.441] IWbemClassObject:Get (in: This=0x6e7a58, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.441] IWbemClassObject:Get (in: This=0x6e7a58, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.441] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0228.441] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0228.442] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.442] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.442] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.442] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.443] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.444] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dda88) returned 0x0 [0228.444] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dda88) returned 0x0 [0228.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.444] WbemDefPath:IUnknown:AddRef (This=0x6dda88) returned 0x3 [0228.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ed020) returned 0x0 [0228.445] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ed020, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.445] WbemDefPath:IUnknown:Release (This=0x6ed020) returned 0x3 [0228.445] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.445] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.445] WbemDefPath:IUnknown:Release (This=0x6dda88) returned 0x2 [0228.445] WbemDefPath:IUnknown:Release (This=0x6dda88) returned 0x1 [0228.446] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.446] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dda88, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dda88) returned 0x0 [0228.446] WbemDefPath:IUnknown:AddRef (This=0x6dda88) returned 0x3 [0228.446] WbemDefPath:IUnknown:Release (This=0x6dda88) returned 0x2 [0228.446] WbemDefPath:IWbemPath:SetText (This=0x6dda88, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.446] IWbemClassObject:Get (in: This=0x6e7a58, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa6c8*=0, plFlavor=0x22aa6cc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf1c, varVal2=0x0), pType=0x22aa6c8*=19, plFlavor=0x22aa6cc*=0) returned 0x0 [0228.447] IWbemClassObject:Get (in: This=0x6e7a58, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa6c8*=19, plFlavor=0x22aa6cc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf1c, varVal2=0x0), pType=0x22aa6c8*=19, plFlavor=0x22aa6cc*=0) returned 0x0 [0228.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.447] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.447] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.447] IWbemClassObject:Get (in: This=0x6e7a58, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa7cc*=0, plFlavor=0x22aa7d0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x22aa7cc*=8, plFlavor=0x22aa7d0*=0) returned 0x0 [0228.447] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0228.447] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0228.447] IWbemClassObject:Get (in: This=0x6e7a58, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa7cc*=8, plFlavor=0x22aa7d0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x22aa7cc*=8, plFlavor=0x22aa7d0*=0) returned 0x0 [0228.447] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0228.448] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0228.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.448] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.448] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.448] IWbemClassObject:Get (in: This=0x6e7a58, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa910*=0, plFlavor=0x22aa914*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ", varVal2=0x0), pType=0x22aa910*=8, plFlavor=0x22aa914*=0) returned 0x0 [0228.448] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0228.448] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0228.448] IWbemClassObject:Get (in: This=0x6e7a58, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aa910*=8, plFlavor=0x22aa914*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ", varVal2=0x0), pType=0x22aa910*=8, plFlavor=0x22aa914*=0) returned 0x0 [0228.448] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0228.448] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0228.448] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.448] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e6c00, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.495] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e6c00) returned 0x0 [0228.495] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.495] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.496] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.496] IUnknown:AddRef (This=0x6e6c00) returned 0x3 [0228.496] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.496] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.496] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e6c04) returned 0x0 [0228.496] IMarshal:GetUnmarshalClass (in: This=0x6e6c04, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.496] IUnknown:Release (This=0x6e6c04) returned 0x3 [0228.496] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.496] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.496] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.497] IUnknown:Release (This=0x6e6c00) returned 0x2 [0228.497] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.497] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.497] IUnknown:QueryInterface (in: This=0x6e6c00, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e6c00) returned 0x0 [0228.497] IUnknown:AddRef (This=0x6e6c00) returned 0x4 [0228.497] IUnknown:Release (This=0x6e6c00) returned 0x3 [0228.497] IUnknown:Release (This=0x6e6c00) returned 0x2 [0228.497] CoTaskMemFree (pv=0x6a3eb8) [0228.497] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.497] IUnknown:AddRef (This=0x6e6c00) returned 0x3 [0228.497] IWbemClassObject:Get (in: This=0x6e6c00, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.498] IWbemClassObject:Get (in: This=0x6e6c00, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.498] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0228.498] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0228.498] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.498] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.498] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.498] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.499] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.500] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddaf8) returned 0x0 [0228.500] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddaf8) returned 0x0 [0228.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.500] WbemDefPath:IUnknown:AddRef (This=0x6ddaf8) returned 0x3 [0228.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ec378) returned 0x0 [0228.501] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ec378, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.501] WbemDefPath:IUnknown:Release (This=0x6ec378) returned 0x3 [0228.501] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.501] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.501] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.501] WbemDefPath:IUnknown:Release (This=0x6ddaf8) returned 0x2 [0228.501] WbemDefPath:IUnknown:Release (This=0x6ddaf8) returned 0x1 [0228.501] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.502] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddaf8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddaf8) returned 0x0 [0228.502] WbemDefPath:IUnknown:AddRef (This=0x6ddaf8) returned 0x3 [0228.502] WbemDefPath:IUnknown:Release (This=0x6ddaf8) returned 0x2 [0228.502] WbemDefPath:IWbemPath:SetText (This=0x6ddaf8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.502] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.502] IWbemClassObject:Get (in: This=0x6e6c00, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab34c*=0, plFlavor=0x22ab350*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x22ab34c*=19, plFlavor=0x22ab350*=0) returned 0x0 [0228.503] IWbemClassObject:Get (in: This=0x6e6c00, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab34c*=19, plFlavor=0x22ab350*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x22ab34c*=19, plFlavor=0x22ab350*=0) returned 0x0 [0228.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.503] IWbemClassObject:Get (in: This=0x6e6c00, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab450*=0, plFlavor=0x22ab454*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x22ab450*=8, plFlavor=0x22ab454*=0) returned 0x0 [0228.503] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0228.503] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0228.504] IWbemClassObject:Get (in: This=0x6e6c00, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab450*=8, plFlavor=0x22ab454*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x22ab450*=8, plFlavor=0x22ab454*=0) returned 0x0 [0228.504] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0228.504] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0228.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.504] IWbemClassObject:Get (in: This=0x6e6c00, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab58c*=0, plFlavor=0x22ab590*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ", varVal2=0x0), pType=0x22ab58c*=8, plFlavor=0x22ab590*=0) returned 0x0 [0228.504] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0228.504] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0228.505] IWbemClassObject:Get (in: This=0x6e6c00, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ab58c*=8, plFlavor=0x22ab590*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ", varVal2=0x0), pType=0x22ab58c*=8, plFlavor=0x22ab590*=0) returned 0x0 [0228.505] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0228.505] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0228.505] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.505] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7bf0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.507] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7bf0) returned 0x0 [0228.507] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.507] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.507] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.508] IUnknown:AddRef (This=0x6e7bf0) returned 0x3 [0228.508] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.508] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.508] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7bf4) returned 0x0 [0228.509] IMarshal:GetUnmarshalClass (in: This=0x6e7bf4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.509] IUnknown:Release (This=0x6e7bf4) returned 0x3 [0228.509] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.509] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.509] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.509] IUnknown:Release (This=0x6e7bf0) returned 0x2 [0228.509] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.509] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.509] IUnknown:QueryInterface (in: This=0x6e7bf0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7bf0) returned 0x0 [0228.509] IUnknown:AddRef (This=0x6e7bf0) returned 0x4 [0228.510] IUnknown:Release (This=0x6e7bf0) returned 0x3 [0228.510] IUnknown:Release (This=0x6e7bf0) returned 0x2 [0228.510] CoTaskMemFree (pv=0x6a3eb8) [0228.510] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.510] IUnknown:AddRef (This=0x6e7bf0) returned 0x3 [0228.510] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.510] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0228.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0228.510] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.511] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.511] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.511] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.512] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.512] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dde08) returned 0x0 [0228.512] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dde08) returned 0x0 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.512] WbemDefPath:IUnknown:AddRef (This=0x6dde08) returned 0x3 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ec2e8) returned 0x0 [0228.513] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ec2e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.513] WbemDefPath:IUnknown:Release (This=0x6ec2e8) returned 0x3 [0228.513] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.513] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.513] WbemDefPath:IUnknown:Release (This=0x6dde08) returned 0x2 [0228.513] WbemDefPath:IUnknown:Release (This=0x6dde08) returned 0x1 [0228.513] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.513] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde08, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dde08) returned 0x0 [0228.513] WbemDefPath:IUnknown:AddRef (This=0x6dde08) returned 0x3 [0228.513] WbemDefPath:IUnknown:Release (This=0x6dde08) returned 0x2 [0228.513] WbemDefPath:IWbemPath:SetText (This=0x6dde08, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x0 [0228.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.514] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22abfe8*=0, plFlavor=0x22abfec*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x22abfe8*=19, plFlavor=0x22abfec*=0) returned 0x0 [0228.514] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22abfe8*=19, plFlavor=0x22abfec*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x22abfe8*=19, plFlavor=0x22abfec*=0) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.515] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ac0ec*=0, plFlavor=0x22ac0f0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x22ac0ec*=8, plFlavor=0x22ac0f0*=0) returned 0x0 [0228.515] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0228.515] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0228.515] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ac0ec*=8, plFlavor=0x22ac0f0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x22ac0ec*=8, plFlavor=0x22ac0f0*=0) returned 0x0 [0228.515] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0228.515] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0228.515] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.515] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.515] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.515] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ac248*=0, plFlavor=0x22ac24c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ", varVal2=0x0), pType=0x22ac248*=8, plFlavor=0x22ac24c*=0) returned 0x0 [0228.516] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0228.516] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0228.517] IWbemClassObject:Get (in: This=0x6e7bf0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ac248*=8, plFlavor=0x22ac24c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ", varVal2=0x0), pType=0x22ac248*=8, plFlavor=0x22ac24c*=0) returned 0x0 [0228.517] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0228.517] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0228.517] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.517] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e7d88, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e7d88) returned 0x0 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.519] IUnknown:AddRef (This=0x6e7d88) returned 0x3 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.519] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.520] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e7d8c) returned 0x0 [0228.520] IMarshal:GetUnmarshalClass (in: This=0x6e7d8c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.520] IUnknown:Release (This=0x6e7d8c) returned 0x3 [0228.520] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.520] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.520] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.520] IUnknown:Release (This=0x6e7d88) returned 0x2 [0228.520] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.520] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.520] IUnknown:QueryInterface (in: This=0x6e7d88, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e7d88) returned 0x0 [0228.521] IUnknown:AddRef (This=0x6e7d88) returned 0x4 [0228.521] IUnknown:Release (This=0x6e7d88) returned 0x3 [0228.521] IUnknown:Release (This=0x6e7d88) returned 0x2 [0228.521] CoTaskMemFree (pv=0x6a3eb8) [0228.521] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.521] IUnknown:AddRef (This=0x6e7d88) returned 0x3 [0228.521] IWbemClassObject:Get (in: This=0x6e7d88, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.521] IWbemClassObject:Get (in: This=0x6e7d88, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.521] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0228.521] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0228.521] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.522] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.522] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.522] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.523] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.523] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dd938) returned 0x0 [0228.524] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dd938) returned 0x0 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.524] WbemDefPath:IUnknown:AddRef (This=0x6dd938) returned 0x3 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.524] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ec660) returned 0x0 [0228.524] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ec660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.525] WbemDefPath:IUnknown:Release (This=0x6ec660) returned 0x3 [0228.525] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.525] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.525] WbemDefPath:IUnknown:Release (This=0x6dd938) returned 0x2 [0228.525] WbemDefPath:IUnknown:Release (This=0x6dd938) returned 0x1 [0228.525] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.525] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dd938, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dd938) returned 0x0 [0228.525] WbemDefPath:IUnknown:AddRef (This=0x6dd938) returned 0x3 [0228.525] WbemDefPath:IUnknown:Release (This=0x6dd938) returned 0x2 [0228.525] WbemDefPath:IWbemPath:SetText (This=0x6dd938, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.526] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.526] IWbemClassObject:Get (in: This=0x6e7d88, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22accd0*=0, plFlavor=0x22accd4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x22accd0*=19, plFlavor=0x22accd4*=0) returned 0x0 [0228.526] IWbemClassObject:Get (in: This=0x6e7d88, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22accd0*=19, plFlavor=0x22accd4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x22accd0*=19, plFlavor=0x22accd4*=0) returned 0x0 [0228.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.527] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.527] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.527] IWbemClassObject:Get (in: This=0x6e7d88, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22acdd4*=0, plFlavor=0x22acdd8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x22acdd4*=8, plFlavor=0x22acdd8*=0) returned 0x0 [0228.527] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0228.527] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0228.527] IWbemClassObject:Get (in: This=0x6e7d88, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22acdd4*=8, plFlavor=0x22acdd8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x22acdd4*=8, plFlavor=0x22acdd8*=0) returned 0x0 [0228.527] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0228.527] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0228.528] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.528] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.528] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.528] IWbemClassObject:Get (in: This=0x6e7d88, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22acf28*=0, plFlavor=0x22acf2c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ", varVal2=0x0), pType=0x22acf28*=8, plFlavor=0x22acf2c*=0) returned 0x0 [0228.528] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0228.528] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0228.528] IWbemClassObject:Get (in: This=0x6e7d88, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22acf28*=8, plFlavor=0x22acf2c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ", varVal2=0x0), pType=0x22acf28*=8, plFlavor=0x22acf2c*=0) returned 0x0 [0228.529] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0228.529] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0228.529] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.529] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e80b8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.584] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e80b8) returned 0x0 [0228.584] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.584] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.584] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.585] IUnknown:AddRef (This=0x6e80b8) returned 0x3 [0228.585] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.585] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.585] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e80bc) returned 0x0 [0228.585] IMarshal:GetUnmarshalClass (in: This=0x6e80bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.585] IUnknown:Release (This=0x6e80bc) returned 0x3 [0228.585] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.586] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.586] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.586] IUnknown:Release (This=0x6e80b8) returned 0x2 [0228.586] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.586] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.586] IUnknown:QueryInterface (in: This=0x6e80b8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e80b8) returned 0x0 [0228.586] IUnknown:AddRef (This=0x6e80b8) returned 0x4 [0228.586] IUnknown:Release (This=0x6e80b8) returned 0x3 [0228.586] IUnknown:Release (This=0x6e80b8) returned 0x2 [0228.586] CoTaskMemFree (pv=0x6a3eb8) [0228.586] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.586] IUnknown:AddRef (This=0x6e80b8) returned 0x3 [0228.587] IWbemClassObject:Get (in: This=0x6e80b8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.587] IWbemClassObject:Get (in: This=0x6e80b8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.587] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0228.587] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0228.587] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.588] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.588] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.588] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.589] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.589] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.589] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6dde78) returned 0x0 [0228.590] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6dde78) returned 0x0 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.590] WbemDefPath:IUnknown:AddRef (This=0x6dde78) returned 0x3 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.590] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ec708) returned 0x0 [0228.591] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ec708, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.591] WbemDefPath:IUnknown:Release (This=0x6ec708) returned 0x3 [0228.591] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.591] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.591] WbemDefPath:IUnknown:Release (This=0x6dde78) returned 0x2 [0228.591] WbemDefPath:IUnknown:Release (This=0x6dde78) returned 0x1 [0228.591] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.591] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.591] WbemDefPath:IUnknown:QueryInterface (in: This=0x6dde78, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6dde78) returned 0x0 [0228.592] WbemDefPath:IUnknown:AddRef (This=0x6dde78) returned 0x3 [0228.592] WbemDefPath:IUnknown:Release (This=0x6dde78) returned 0x2 [0228.592] WbemDefPath:IWbemPath:SetText (This=0x6dde78, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x0 [0228.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.592] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.592] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.593] IWbemClassObject:Get (in: This=0x6e80b8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad9b8*=0, plFlavor=0x22ad9bc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf4c, varVal2=0x0), pType=0x22ad9b8*=19, plFlavor=0x22ad9bc*=0) returned 0x0 [0228.593] IWbemClassObject:Get (in: This=0x6e80b8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ad9b8*=19, plFlavor=0x22ad9bc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf4c, varVal2=0x0), pType=0x22ad9b8*=19, plFlavor=0x22ad9bc*=0) returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.593] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.594] IWbemClassObject:Get (in: This=0x6e80b8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adabc*=0, plFlavor=0x22adac0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x22adabc*=8, plFlavor=0x22adac0*=0) returned 0x0 [0228.594] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0228.594] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0228.594] IWbemClassObject:Get (in: This=0x6e80b8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adabc*=8, plFlavor=0x22adac0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x22adabc*=8, plFlavor=0x22adac0*=0) returned 0x0 [0228.594] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0228.594] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0228.595] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.595] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.595] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.595] IWbemClassObject:Get (in: This=0x6e80b8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adbf8*=0, plFlavor=0x22adbfc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\accupos.exe\" ", varVal2=0x0), pType=0x22adbf8*=8, plFlavor=0x22adbfc*=0) returned 0x0 [0228.595] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0228.595] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0228.595] IWbemClassObject:Get (in: This=0x6e80b8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22adbf8*=8, plFlavor=0x22adbfc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\accupos.exe\" ", varVal2=0x0), pType=0x22adbf8*=8, plFlavor=0x22adbfc*=0) returned 0x0 [0228.595] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0228.596] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0228.596] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.596] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e6d98, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.599] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e6d98) returned 0x0 [0228.599] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.599] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.599] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.600] IUnknown:AddRef (This=0x6e6d98) returned 0x3 [0228.600] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.600] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.600] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e6d9c) returned 0x0 [0228.600] IMarshal:GetUnmarshalClass (in: This=0x6e6d9c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.600] IUnknown:Release (This=0x6e6d9c) returned 0x3 [0228.600] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.601] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.601] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.601] IUnknown:Release (This=0x6e6d98) returned 0x2 [0228.601] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.601] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.601] IUnknown:QueryInterface (in: This=0x6e6d98, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e6d98) returned 0x0 [0228.601] IUnknown:AddRef (This=0x6e6d98) returned 0x4 [0228.601] IUnknown:Release (This=0x6e6d98) returned 0x3 [0228.601] IUnknown:Release (This=0x6e6d98) returned 0x2 [0228.601] CoTaskMemFree (pv=0x6a3eb8) [0228.601] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.601] IUnknown:AddRef (This=0x6e6d98) returned 0x3 [0228.602] IWbemClassObject:Get (in: This=0x6e6d98, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.602] IWbemClassObject:Get (in: This=0x6e6d98, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.602] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0228.602] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0228.602] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.602] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.602] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.603] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.604] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.604] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6ddf58) returned 0x0 [0228.605] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6ddf58) returned 0x0 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.605] WbemDefPath:IUnknown:AddRef (This=0x6ddf58) returned 0x3 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ec780) returned 0x0 [0228.605] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ec780, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.606] WbemDefPath:IUnknown:Release (This=0x6ec780) returned 0x3 [0228.606] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.606] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.606] WbemDefPath:IUnknown:Release (This=0x6ddf58) returned 0x2 [0228.606] WbemDefPath:IUnknown:Release (This=0x6ddf58) returned 0x1 [0228.606] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.606] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.606] WbemDefPath:IUnknown:QueryInterface (in: This=0x6ddf58, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6ddf58) returned 0x0 [0228.606] WbemDefPath:IUnknown:AddRef (This=0x6ddf58) returned 0x3 [0228.607] WbemDefPath:IUnknown:Release (This=0x6ddf58) returned 0x2 [0228.607] WbemDefPath:IWbemPath:SetText (This=0x6ddf58, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.607] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.607] IWbemClassObject:Get (in: This=0x6e6d98, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae5f8*=0, plFlavor=0x22ae5fc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf58, varVal2=0x0), pType=0x22ae5f8*=19, plFlavor=0x22ae5fc*=0) returned 0x0 [0228.607] IWbemClassObject:Get (in: This=0x6e6d98, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae5f8*=19, plFlavor=0x22ae5fc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf58, varVal2=0x0), pType=0x22ae5f8*=19, plFlavor=0x22ae5fc*=0) returned 0x0 [0228.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.608] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.608] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.608] IWbemClassObject:Get (in: This=0x6e6d98, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae6fc*=0, plFlavor=0x22ae700*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x22ae6fc*=8, plFlavor=0x22ae700*=0) returned 0x0 [0228.608] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0228.608] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0228.608] IWbemClassObject:Get (in: This=0x6e6d98, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae6fc*=8, plFlavor=0x22ae700*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x22ae6fc*=8, plFlavor=0x22ae700*=0) returned 0x0 [0228.608] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0228.608] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0228.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.609] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.609] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.609] IWbemClassObject:Get (in: This=0x6e6d98, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae830*=0, plFlavor=0x22ae834*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ", varVal2=0x0), pType=0x22ae830*=8, plFlavor=0x22ae834*=0) returned 0x0 [0228.609] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0228.609] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0228.609] IWbemClassObject:Get (in: This=0x6e6d98, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ae830*=8, plFlavor=0x22ae834*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ", varVal2=0x0), pType=0x22ae830*=8, plFlavor=0x22ae834*=0) returned 0x0 [0228.611] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0228.611] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0228.611] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.611] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e83e8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e83e8) returned 0x0 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.613] IUnknown:AddRef (This=0x6e83e8) returned 0x3 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.613] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e83ec) returned 0x0 [0228.614] IMarshal:GetUnmarshalClass (in: This=0x6e83ec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.614] IUnknown:Release (This=0x6e83ec) returned 0x3 [0228.614] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.614] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.614] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.614] IUnknown:Release (This=0x6e83e8) returned 0x2 [0228.614] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.614] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.614] IUnknown:QueryInterface (in: This=0x6e83e8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e83e8) returned 0x0 [0228.614] IUnknown:AddRef (This=0x6e83e8) returned 0x4 [0228.614] IUnknown:Release (This=0x6e83e8) returned 0x3 [0228.614] IUnknown:Release (This=0x6e83e8) returned 0x2 [0228.615] CoTaskMemFree (pv=0x6a3eb8) [0228.615] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.615] IUnknown:AddRef (This=0x6e83e8) returned 0x3 [0228.615] IWbemClassObject:Get (in: This=0x6e83e8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.615] IWbemClassObject:Get (in: This=0x6e83e8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.615] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0228.615] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0228.615] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.616] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.616] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.616] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.617] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.617] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de2d8) returned 0x0 [0228.617] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de2d8) returned 0x0 [0228.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.618] WbemDefPath:IUnknown:AddRef (This=0x6de2d8) returned 0x3 [0228.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6eccd8) returned 0x0 [0228.618] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6eccd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.618] WbemDefPath:IUnknown:Release (This=0x6eccd8) returned 0x3 [0228.619] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.619] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.619] WbemDefPath:IUnknown:Release (This=0x6de2d8) returned 0x2 [0228.619] WbemDefPath:IUnknown:Release (This=0x6de2d8) returned 0x1 [0228.619] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.619] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de2d8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de2d8) returned 0x0 [0228.619] WbemDefPath:IUnknown:AddRef (This=0x6de2d8) returned 0x3 [0228.619] WbemDefPath:IUnknown:Release (This=0x6de2d8) returned 0x2 [0228.620] WbemDefPath:IWbemPath:SetText (This=0x6de2d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.620] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.621] IWbemClassObject:Get (in: This=0x6e83e8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af280*=0, plFlavor=0x22af284*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x22af280*=19, plFlavor=0x22af284*=0) returned 0x0 [0228.621] IWbemClassObject:Get (in: This=0x6e83e8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af280*=19, plFlavor=0x22af284*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x22af280*=19, plFlavor=0x22af284*=0) returned 0x0 [0228.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.621] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.621] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.621] IWbemClassObject:Get (in: This=0x6e83e8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af384*=0, plFlavor=0x22af388*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x22af384*=8, plFlavor=0x22af388*=0) returned 0x0 [0228.622] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0228.622] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0228.622] IWbemClassObject:Get (in: This=0x6e83e8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af384*=8, plFlavor=0x22af388*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x22af384*=8, plFlavor=0x22af388*=0) returned 0x0 [0228.622] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0228.622] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0228.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.622] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.622] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.622] IWbemClassObject:Get (in: This=0x6e83e8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af4c0*=0, plFlavor=0x22af4c4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ", varVal2=0x0), pType=0x22af4c0*=8, plFlavor=0x22af4c4*=0) returned 0x0 [0228.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0228.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0228.623] IWbemClassObject:Get (in: This=0x6e83e8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22af4c0*=8, plFlavor=0x22af4c4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ", varVal2=0x0), pType=0x22af4c0*=8, plFlavor=0x22af4c4*=0) returned 0x0 [0228.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0228.623] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0228.623] CoTaskMemAlloc (cb=0x4) returned 0x6a3ed8 [0228.623] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ed8, puReturned=0x227e9dc | out: apObjects=0x6a3ed8*=0x6e6f30, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.717] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e6f30) returned 0x0 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.718] IUnknown:AddRef (This=0x6e6f30) returned 0x3 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.718] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e6f34) returned 0x0 [0228.719] IMarshal:GetUnmarshalClass (in: This=0x6e6f34, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.719] IUnknown:Release (This=0x6e6f34) returned 0x3 [0228.720] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.720] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.720] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.720] IUnknown:Release (This=0x6e6f30) returned 0x2 [0228.720] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.721] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.721] IUnknown:QueryInterface (in: This=0x6e6f30, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e6f30) returned 0x0 [0228.721] IUnknown:AddRef (This=0x6e6f30) returned 0x4 [0228.721] IUnknown:Release (This=0x6e6f30) returned 0x3 [0228.721] IUnknown:Release (This=0x6e6f30) returned 0x2 [0228.721] CoTaskMemFree (pv=0x6a3ed8) [0228.721] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.721] IUnknown:AddRef (This=0x6e6f30) returned 0x3 [0228.721] IWbemClassObject:Get (in: This=0x6e6f30, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.722] IWbemClassObject:Get (in: This=0x6e6f30, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.722] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0228.722] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0228.722] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.722] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.722] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.722] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.724] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.724] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de348) returned 0x0 [0228.724] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de348) returned 0x0 [0228.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.725] WbemDefPath:IUnknown:AddRef (This=0x6de348) returned 0x3 [0228.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6ecb88) returned 0x0 [0228.725] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6ecb88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.725] WbemDefPath:IUnknown:Release (This=0x6ecb88) returned 0x3 [0228.725] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.726] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.726] WbemDefPath:IUnknown:Release (This=0x6de348) returned 0x2 [0228.726] WbemDefPath:IUnknown:Release (This=0x6de348) returned 0x1 [0228.726] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.726] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de348, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de348) returned 0x0 [0228.726] WbemDefPath:IUnknown:AddRef (This=0x6de348) returned 0x3 [0228.726] WbemDefPath:IUnknown:Release (This=0x6de348) returned 0x2 [0228.726] WbemDefPath:IWbemPath:SetText (This=0x6de348, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x0 [0228.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.727] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.727] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.727] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.727] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.728] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.728] IWbemClassObject:Get (in: This=0x6e6f30, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aff20*=0, plFlavor=0x22aff24*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf74, varVal2=0x0), pType=0x22aff20*=19, plFlavor=0x22aff24*=0) returned 0x0 [0228.728] IWbemClassObject:Get (in: This=0x6e6f30, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22aff20*=19, plFlavor=0x22aff24*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf74, varVal2=0x0), pType=0x22aff20*=19, plFlavor=0x22aff24*=0) returned 0x0 [0228.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.728] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.729] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.729] IWbemClassObject:Get (in: This=0x6e6f30, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0024*=0, plFlavor=0x22b0028*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x22b0024*=8, plFlavor=0x22b0028*=0) returned 0x0 [0228.729] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0228.729] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0228.729] IWbemClassObject:Get (in: This=0x6e6f30, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0024*=8, plFlavor=0x22b0028*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x22b0024*=8, plFlavor=0x22b0028*=0) returned 0x0 [0228.729] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0228.729] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0228.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.730] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.730] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.730] IWbemClassObject:Get (in: This=0x6e6f30, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0170*=0, plFlavor=0x22b0174*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ", varVal2=0x0), pType=0x22b0170*=8, plFlavor=0x22b0174*=0) returned 0x0 [0228.730] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0228.730] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0228.730] IWbemClassObject:Get (in: This=0x6e6f30, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0170*=8, plFlavor=0x22b0174*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ", varVal2=0x0), pType=0x22b0170*=8, plFlavor=0x22b0174*=0) returned 0x0 [0228.730] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0228.731] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0228.731] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.731] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6e68d0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.733] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6e68d0) returned 0x0 [0228.733] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.733] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.733] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.733] IUnknown:AddRef (This=0x6e68d0) returned 0x3 [0228.734] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.734] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.734] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6e68d4) returned 0x0 [0228.734] IMarshal:GetUnmarshalClass (in: This=0x6e68d4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.734] IUnknown:Release (This=0x6e68d4) returned 0x3 [0228.734] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.734] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.734] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.735] IUnknown:Release (This=0x6e68d0) returned 0x2 [0228.735] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.735] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.735] IUnknown:QueryInterface (in: This=0x6e68d0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6e68d0) returned 0x0 [0228.735] IUnknown:AddRef (This=0x6e68d0) returned 0x4 [0228.735] IUnknown:Release (This=0x6e68d0) returned 0x3 [0228.736] IUnknown:Release (This=0x6e68d0) returned 0x2 [0228.736] CoTaskMemFree (pv=0x6a3eb8) [0228.736] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.736] IUnknown:AddRef (This=0x6e68d0) returned 0x3 [0228.736] IWbemClassObject:Get (in: This=0x6e68d0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.736] IWbemClassObject:Get (in: This=0x6e68d0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0228.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0228.736] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.737] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.737] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.737] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.738] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.738] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de3b8) returned 0x0 [0228.738] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de3b8) returned 0x0 [0228.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.739] WbemDefPath:IUnknown:AddRef (This=0x6de3b8) returned 0x3 [0228.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0968) returned 0x0 [0228.739] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0968, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.739] WbemDefPath:IUnknown:Release (This=0x6f0968) returned 0x3 [0228.740] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.740] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.740] WbemDefPath:IUnknown:Release (This=0x6de3b8) returned 0x2 [0228.740] WbemDefPath:IUnknown:Release (This=0x6de3b8) returned 0x1 [0228.740] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.740] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de3b8, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de3b8) returned 0x0 [0228.740] WbemDefPath:IUnknown:AddRef (This=0x6de3b8) returned 0x3 [0228.740] WbemDefPath:IUnknown:Release (This=0x6de3b8) returned 0x2 [0228.740] WbemDefPath:IWbemPath:SetText (This=0x6de3b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x0 [0228.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.741] IWbemClassObject:Get (in: This=0x6e68d0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0be4*=0, plFlavor=0x22b0be8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x22b0be4*=19, plFlavor=0x22b0be8*=0) returned 0x0 [0228.741] IWbemClassObject:Get (in: This=0x6e68d0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0be4*=19, plFlavor=0x22b0be8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x22b0be4*=19, plFlavor=0x22b0be8*=0) returned 0x0 [0228.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.742] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.742] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.742] IWbemClassObject:Get (in: This=0x6e68d0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0ce8*=0, plFlavor=0x22b0cec*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x22b0ce8*=8, plFlavor=0x22b0cec*=0) returned 0x0 [0228.742] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0228.742] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0228.742] IWbemClassObject:Get (in: This=0x6e68d0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0ce8*=8, plFlavor=0x22b0cec*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x22b0ce8*=8, plFlavor=0x22b0cec*=0) returned 0x0 [0228.742] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0228.742] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0228.742] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.743] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.743] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.743] IWbemClassObject:Get (in: This=0x6e68d0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0e4c*=0, plFlavor=0x22b0e50*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ", varVal2=0x0), pType=0x22b0e4c*=8, plFlavor=0x22b0e50*=0) returned 0x0 [0228.743] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0228.743] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0228.743] IWbemClassObject:Get (in: This=0x6e68d0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b0e4c*=8, plFlavor=0x22b0e50*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ", varVal2=0x0), pType=0x22b0e4c*=8, plFlavor=0x22b0e50*=0) returned 0x0 [0228.743] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0228.743] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0228.744] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.744] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f3258, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.792] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3258) returned 0x0 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.793] IUnknown:AddRef (This=0x6f3258) returned 0x3 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.793] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f325c) returned 0x0 [0228.794] IMarshal:GetUnmarshalClass (in: This=0x6f325c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.794] IUnknown:Release (This=0x6f325c) returned 0x3 [0228.794] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.794] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.794] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.794] IUnknown:Release (This=0x6f3258) returned 0x2 [0228.794] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.794] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.794] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3258) returned 0x0 [0228.795] IUnknown:AddRef (This=0x6f3258) returned 0x4 [0228.795] IUnknown:Release (This=0x6f3258) returned 0x3 [0228.795] IUnknown:Release (This=0x6f3258) returned 0x2 [0228.795] CoTaskMemFree (pv=0x6a3eb8) [0228.795] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.795] IUnknown:AddRef (This=0x6f3258) returned 0x3 [0228.795] IWbemClassObject:Get (in: This=0x6f3258, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.795] IWbemClassObject:Get (in: This=0x6f3258, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.795] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0228.796] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0228.796] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.796] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.796] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.796] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.798] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.798] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.798] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6de268) returned 0x0 [0228.798] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6de268) returned 0x0 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.799] WbemDefPath:IUnknown:AddRef (This=0x6de268) returned 0x3 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.799] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f08a8) returned 0x0 [0228.799] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f08a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.799] WbemDefPath:IUnknown:Release (This=0x6f08a8) returned 0x3 [0228.800] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.800] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.800] WbemDefPath:IUnknown:Release (This=0x6de268) returned 0x2 [0228.800] WbemDefPath:IUnknown:Release (This=0x6de268) returned 0x1 [0228.800] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.800] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.800] WbemDefPath:IUnknown:QueryInterface (in: This=0x6de268, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6de268) returned 0x0 [0228.800] WbemDefPath:IUnknown:AddRef (This=0x6de268) returned 0x3 [0228.800] WbemDefPath:IUnknown:Release (This=0x6de268) returned 0x2 [0228.801] WbemDefPath:IWbemPath:SetText (This=0x6de268, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.801] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.801] IWbemClassObject:Get (in: This=0x6f3258, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b18e4*=0, plFlavor=0x22b18e8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x22b18e4*=19, plFlavor=0x22b18e8*=0) returned 0x0 [0228.801] IWbemClassObject:Get (in: This=0x6f3258, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b18e4*=19, plFlavor=0x22b18e8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x22b18e4*=19, plFlavor=0x22b18e8*=0) returned 0x0 [0228.802] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.802] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.802] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.802] IWbemClassObject:Get (in: This=0x6f3258, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b19e8*=0, plFlavor=0x22b19ec*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x22b19e8*=8, plFlavor=0x22b19ec*=0) returned 0x0 [0228.802] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0228.802] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0228.802] IWbemClassObject:Get (in: This=0x6f3258, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b19e8*=8, plFlavor=0x22b19ec*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x22b19e8*=8, plFlavor=0x22b19ec*=0) returned 0x0 [0228.802] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0228.803] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0228.803] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.803] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.803] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.803] IWbemClassObject:Get (in: This=0x6f3258, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b1b3c*=0, plFlavor=0x22b1b40*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ", varVal2=0x0), pType=0x22b1b3c*=8, plFlavor=0x22b1b40*=0) returned 0x0 [0228.803] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0228.803] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0228.803] IWbemClassObject:Get (in: This=0x6f3258, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b1b3c*=8, plFlavor=0x22b1b40*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ", varVal2=0x0), pType=0x22b1b3c*=8, plFlavor=0x22b1b40*=0) returned 0x0 [0228.804] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0228.804] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0228.804] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.804] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f40b0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f40b0) returned 0x0 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.806] IUnknown:AddRef (This=0x6f40b0) returned 0x3 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.806] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.807] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f40b4) returned 0x0 [0228.807] IMarshal:GetUnmarshalClass (in: This=0x6f40b4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.807] IUnknown:Release (This=0x6f40b4) returned 0x3 [0228.807] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.807] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.807] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.807] IUnknown:Release (This=0x6f40b0) returned 0x2 [0228.807] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.807] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.807] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f40b0) returned 0x0 [0228.808] IUnknown:AddRef (This=0x6f40b0) returned 0x4 [0228.808] IUnknown:Release (This=0x6f40b0) returned 0x3 [0228.808] IUnknown:Release (This=0x6f40b0) returned 0x2 [0228.808] CoTaskMemFree (pv=0x6a3eb8) [0228.808] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.808] IUnknown:AddRef (This=0x6f40b0) returned 0x3 [0228.808] IWbemClassObject:Get (in: This=0x6f40b0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.808] IWbemClassObject:Get (in: This=0x6f40b0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.808] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0228.809] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0228.809] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.809] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.809] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.809] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.812] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.812] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f47f0) returned 0x0 [0228.812] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f47f0) returned 0x0 [0228.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.813] WbemDefPath:IUnknown:AddRef (This=0x6f47f0) returned 0x3 [0228.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0d58) returned 0x0 [0228.813] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0d58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.813] WbemDefPath:IUnknown:Release (This=0x6f0d58) returned 0x3 [0228.813] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.814] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.814] WbemDefPath:IUnknown:Release (This=0x6f47f0) returned 0x2 [0228.814] WbemDefPath:IUnknown:Release (This=0x6f47f0) returned 0x1 [0228.814] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.814] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f47f0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f47f0) returned 0x0 [0228.814] WbemDefPath:IUnknown:AddRef (This=0x6f47f0) returned 0x3 [0228.814] WbemDefPath:IUnknown:Release (This=0x6f47f0) returned 0x2 [0228.814] WbemDefPath:IWbemPath:SetText (This=0x6f47f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x0 [0228.814] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.815] IWbemClassObject:Get (in: This=0x6f40b0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b25cc*=0, plFlavor=0x22b25d0*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf98, varVal2=0x0), pType=0x22b25cc*=19, plFlavor=0x22b25d0*=0) returned 0x0 [0228.815] IWbemClassObject:Get (in: This=0x6f40b0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b25cc*=19, plFlavor=0x22b25d0*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf98, varVal2=0x0), pType=0x22b25cc*=19, plFlavor=0x22b25d0*=0) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.815] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.816] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.816] IWbemClassObject:Get (in: This=0x6f40b0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b26d0*=0, plFlavor=0x22b26d4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x22b26d0*=8, plFlavor=0x22b26d4*=0) returned 0x0 [0228.816] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0228.816] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0228.816] IWbemClassObject:Get (in: This=0x6f40b0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b26d0*=8, plFlavor=0x22b26d4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x22b26d0*=8, plFlavor=0x22b26d4*=0) returned 0x0 [0228.816] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0228.816] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0228.816] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.817] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.817] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.817] IWbemClassObject:Get (in: This=0x6f40b0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b280c*=0, plFlavor=0x22b2810*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ", varVal2=0x0), pType=0x22b280c*=8, plFlavor=0x22b2810*=0) returned 0x0 [0228.817] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0228.817] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0228.817] IWbemClassObject:Get (in: This=0x6f40b0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b280c*=8, plFlavor=0x22b2810*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ", varVal2=0x0), pType=0x22b280c*=8, plFlavor=0x22b2810*=0) returned 0x0 [0228.817] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0228.817] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0228.818] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.818] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f2d90, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.819] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2d90) returned 0x0 [0228.819] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.819] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.819] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.820] IUnknown:AddRef (This=0x6f2d90) returned 0x3 [0228.820] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.820] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.820] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f2d94) returned 0x0 [0228.820] IMarshal:GetUnmarshalClass (in: This=0x6f2d94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.820] IUnknown:Release (This=0x6f2d94) returned 0x3 [0228.820] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.821] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.821] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.821] IUnknown:Release (This=0x6f2d90) returned 0x2 [0228.821] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.821] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.821] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2d90) returned 0x0 [0228.821] IUnknown:AddRef (This=0x6f2d90) returned 0x4 [0228.821] IUnknown:Release (This=0x6f2d90) returned 0x3 [0228.821] IUnknown:Release (This=0x6f2d90) returned 0x2 [0228.821] CoTaskMemFree (pv=0x6a3eb8) [0228.821] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.821] IUnknown:AddRef (This=0x6f2d90) returned 0x3 [0228.822] IWbemClassObject:Get (in: This=0x6f2d90, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.822] IWbemClassObject:Get (in: This=0x6f2d90, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0228.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0228.822] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.823] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.823] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.824] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.824] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4e10) returned 0x0 [0228.824] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4e10) returned 0x0 [0228.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.825] WbemDefPath:IUnknown:AddRef (This=0x6f4e10) returned 0x3 [0228.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f10e8) returned 0x0 [0228.825] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f10e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.825] WbemDefPath:IUnknown:Release (This=0x6f10e8) returned 0x3 [0228.826] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.826] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.826] WbemDefPath:IUnknown:Release (This=0x6f4e10) returned 0x2 [0228.826] WbemDefPath:IUnknown:Release (This=0x6f4e10) returned 0x1 [0228.826] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.826] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e10, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4e10) returned 0x0 [0228.826] WbemDefPath:IUnknown:AddRef (This=0x6f4e10) returned 0x3 [0228.826] WbemDefPath:IUnknown:Release (This=0x6f4e10) returned 0x2 [0228.826] WbemDefPath:IWbemPath:SetText (This=0x6f4e10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x0 [0228.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.827] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.827] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.827] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.827] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.828] IWbemClassObject:Get (in: This=0x6f2d90, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b3490*=0, plFlavor=0x22b3494*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x22b3490*=19, plFlavor=0x22b3494*=0) returned 0x0 [0228.828] IWbemClassObject:Get (in: This=0x6f2d90, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b3490*=19, plFlavor=0x22b3494*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x22b3490*=19, plFlavor=0x22b3494*=0) returned 0x0 [0228.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.828] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.877] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.878] IWbemClassObject:Get (in: This=0x6f2d90, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b3594*=0, plFlavor=0x22b3598*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x22b3594*=8, plFlavor=0x22b3598*=0) returned 0x0 [0228.878] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0228.878] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0228.878] IWbemClassObject:Get (in: This=0x6f2d90, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b3594*=8, plFlavor=0x22b3598*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x22b3594*=8, plFlavor=0x22b3598*=0) returned 0x0 [0228.878] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0228.878] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0228.879] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.879] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.879] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.879] IWbemClassObject:Get (in: This=0x6f2d90, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b36c8*=0, plFlavor=0x22b36cc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ", varVal2=0x0), pType=0x22b36c8*=8, plFlavor=0x22b36cc*=0) returned 0x0 [0228.879] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0228.879] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0228.879] IWbemClassObject:Get (in: This=0x6f2d90, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b36c8*=8, plFlavor=0x22b36cc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ", varVal2=0x0), pType=0x22b36c8*=8, plFlavor=0x22b36cc*=0) returned 0x0 [0228.879] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0228.879] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0228.880] CoTaskMemAlloc (cb=0x4) returned 0x6a3ed8 [0228.880] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ed8, puReturned=0x227e9dc | out: apObjects=0x6a3ed8*=0x6f3be8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.881] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3be8) returned 0x0 [0228.882] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.882] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.882] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.883] IUnknown:AddRef (This=0x6f3be8) returned 0x3 [0228.883] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.883] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.883] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f3bec) returned 0x0 [0228.883] IMarshal:GetUnmarshalClass (in: This=0x6f3bec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.883] IUnknown:Release (This=0x6f3bec) returned 0x3 [0228.883] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.883] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.883] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.883] IUnknown:Release (This=0x6f3be8) returned 0x2 [0228.884] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.884] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.884] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3be8) returned 0x0 [0228.884] IUnknown:AddRef (This=0x6f3be8) returned 0x4 [0228.884] IUnknown:Release (This=0x6f3be8) returned 0x3 [0228.884] IUnknown:Release (This=0x6f3be8) returned 0x2 [0228.884] CoTaskMemFree (pv=0x6a3ed8) [0228.884] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.884] IUnknown:AddRef (This=0x6f3be8) returned 0x3 [0228.884] IWbemClassObject:Get (in: This=0x6f3be8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.884] IWbemClassObject:Get (in: This=0x6f3be8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0228.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0228.885] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.885] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.885] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.885] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.886] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4cc0) returned 0x0 [0228.887] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4cc0) returned 0x0 [0228.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.888] WbemDefPath:IUnknown:AddRef (This=0x6f4cc0) returned 0x3 [0228.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0f50) returned 0x0 [0228.888] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0f50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.888] WbemDefPath:IUnknown:Release (This=0x6f0f50) returned 0x3 [0228.888] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.888] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.888] WbemDefPath:IUnknown:Release (This=0x6f4cc0) returned 0x2 [0228.888] WbemDefPath:IUnknown:Release (This=0x6f4cc0) returned 0x1 [0228.889] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.889] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.889] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4cc0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4cc0) returned 0x0 [0228.889] WbemDefPath:IUnknown:AddRef (This=0x6f4cc0) returned 0x3 [0228.889] WbemDefPath:IUnknown:Release (This=0x6f4cc0) returned 0x2 [0228.889] WbemDefPath:IWbemPath:SetText (This=0x6f4cc0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x0 [0228.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.889] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.889] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.890] IWbemClassObject:Get (in: This=0x6f3be8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4120*=0, plFlavor=0x22b4124*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb4, varVal2=0x0), pType=0x22b4120*=19, plFlavor=0x22b4124*=0) returned 0x0 [0228.890] IWbemClassObject:Get (in: This=0x6f3be8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4120*=19, plFlavor=0x22b4124*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb4, varVal2=0x0), pType=0x22b4120*=19, plFlavor=0x22b4124*=0) returned 0x0 [0228.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.891] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.893] IWbemClassObject:Get (in: This=0x6f3be8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4224*=0, plFlavor=0x22b4228*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x22b4224*=8, plFlavor=0x22b4228*=0) returned 0x0 [0228.893] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0228.893] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0228.893] IWbemClassObject:Get (in: This=0x6f3be8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4224*=8, plFlavor=0x22b4228*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x22b4224*=8, plFlavor=0x22b4228*=0) returned 0x0 [0228.893] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0228.893] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0228.893] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.894] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.894] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.894] IWbemClassObject:Get (in: This=0x6f3be8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4360*=0, plFlavor=0x22b4364*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ", varVal2=0x0), pType=0x22b4360*=8, plFlavor=0x22b4364*=0) returned 0x0 [0228.894] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0228.894] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0228.894] IWbemClassObject:Get (in: This=0x6f3be8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4360*=8, plFlavor=0x22b4364*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ", varVal2=0x0), pType=0x22b4360*=8, plFlavor=0x22b4364*=0) returned 0x0 [0228.894] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0228.895] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0228.895] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.895] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f38b8, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.896] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f38b8) returned 0x0 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.897] IUnknown:AddRef (This=0x6f38b8) returned 0x3 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.897] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f38bc) returned 0x0 [0228.897] IMarshal:GetUnmarshalClass (in: This=0x6f38bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.898] IUnknown:Release (This=0x6f38bc) returned 0x3 [0228.898] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.898] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.898] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.898] IUnknown:Release (This=0x6f38b8) returned 0x2 [0228.898] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.898] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.898] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f38b8) returned 0x0 [0228.898] IUnknown:AddRef (This=0x6f38b8) returned 0x4 [0228.898] IUnknown:Release (This=0x6f38b8) returned 0x3 [0228.898] IUnknown:Release (This=0x6f38b8) returned 0x2 [0228.899] CoTaskMemFree (pv=0x6a3eb8) [0228.899] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.899] IUnknown:AddRef (This=0x6f38b8) returned 0x3 [0228.899] IWbemClassObject:Get (in: This=0x6f38b8, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.899] IWbemClassObject:Get (in: This=0x6f38b8, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0228.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0228.899] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.900] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.900] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.900] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.901] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.901] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f48d0) returned 0x0 [0228.901] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f48d0) returned 0x0 [0228.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.902] WbemDefPath:IUnknown:AddRef (This=0x6f48d0) returned 0x3 [0228.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1478) returned 0x0 [0228.902] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1478, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.902] WbemDefPath:IUnknown:Release (This=0x6f1478) returned 0x3 [0228.902] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.902] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.903] WbemDefPath:IUnknown:Release (This=0x6f48d0) returned 0x2 [0228.903] WbemDefPath:IUnknown:Release (This=0x6f48d0) returned 0x1 [0228.903] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.903] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f48d0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f48d0) returned 0x0 [0228.903] WbemDefPath:IUnknown:AddRef (This=0x6f48d0) returned 0x3 [0228.903] WbemDefPath:IUnknown:Release (This=0x6f48d0) returned 0x2 [0228.903] WbemDefPath:IWbemPath:SetText (This=0x6f48d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x0 [0228.903] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.903] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.903] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.903] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.903] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.904] IWbemClassObject:Get (in: This=0x6f38b8, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4dd8*=0, plFlavor=0x22b4ddc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x22b4dd8*=19, plFlavor=0x22b4ddc*=0) returned 0x0 [0228.904] IWbemClassObject:Get (in: This=0x6f38b8, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4dd8*=19, plFlavor=0x22b4ddc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x22b4dd8*=19, plFlavor=0x22b4ddc*=0) returned 0x0 [0228.904] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.904] IWbemClassObject:Get (in: This=0x6f38b8, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4edc*=0, plFlavor=0x22b4ee0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x22b4edc*=8, plFlavor=0x22b4ee0*=0) returned 0x0 [0228.905] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0228.905] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0228.905] IWbemClassObject:Get (in: This=0x6f38b8, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b4edc*=8, plFlavor=0x22b4ee0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x22b4edc*=8, plFlavor=0x22b4ee0*=0) returned 0x0 [0228.905] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0228.905] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0228.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.905] IWbemClassObject:Get (in: This=0x6f38b8, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5030*=0, plFlavor=0x22b5034*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ", varVal2=0x0), pType=0x22b5030*=8, plFlavor=0x22b5034*=0) returned 0x0 [0228.906] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0228.906] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0228.906] IWbemClassObject:Get (in: This=0x6f38b8, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5030*=8, plFlavor=0x22b5034*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ", varVal2=0x0), pType=0x22b5030*=8, plFlavor=0x22b5034*=0) returned 0x0 [0228.906] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0228.906] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0228.906] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0228.906] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f33f0, puReturned=0x227e9dc*=0x1) returned 0x0 [0228.959] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f33f0) returned 0x0 [0228.959] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0228.959] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0228.959] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0228.960] IUnknown:AddRef (This=0x6f33f0) returned 0x3 [0228.960] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0228.960] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0228.960] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f33f4) returned 0x0 [0228.960] IMarshal:GetUnmarshalClass (in: This=0x6f33f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0228.960] IUnknown:Release (This=0x6f33f4) returned 0x3 [0228.960] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0228.960] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0228.961] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0228.961] IUnknown:Release (This=0x6f33f0) returned 0x2 [0228.961] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0228.961] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0228.961] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f33f0) returned 0x0 [0228.961] IUnknown:AddRef (This=0x6f33f0) returned 0x4 [0228.961] IUnknown:Release (This=0x6f33f0) returned 0x3 [0228.961] IUnknown:Release (This=0x6f33f0) returned 0x2 [0228.961] CoTaskMemFree (pv=0x6a3eb8) [0228.961] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0228.961] IUnknown:AddRef (This=0x6f33f0) returned 0x3 [0228.961] IWbemClassObject:Get (in: This=0x6f33f0, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0228.962] IWbemClassObject:Get (in: This=0x6f33f0, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0228.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0228.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0228.962] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0228.962] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0228.962] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0228.962] IUnknown:Release (This=0x692bc4) returned 0x1 [0228.964] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0228.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0228.964] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f5200) returned 0x0 [0228.964] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0228.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f5200) returned 0x0 [0228.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0228.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0228.965] WbemDefPath:IUnknown:AddRef (This=0x6f5200) returned 0x3 [0228.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0228.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0228.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1280) returned 0x0 [0228.965] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1280, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0228.965] WbemDefPath:IUnknown:Release (This=0x6f1280) returned 0x3 [0228.965] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0228.965] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0228.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0228.966] WbemDefPath:IUnknown:Release (This=0x6f5200) returned 0x2 [0228.966] WbemDefPath:IUnknown:Release (This=0x6f5200) returned 0x1 [0228.966] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0228.966] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0228.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5200, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f5200) returned 0x0 [0228.966] WbemDefPath:IUnknown:AddRef (This=0x6f5200) returned 0x3 [0228.966] WbemDefPath:IUnknown:Release (This=0x6f5200) returned 0x2 [0228.966] WbemDefPath:IWbemPath:SetText (This=0x6f5200, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.967] IWbemClassObject:Get (in: This=0x6f33f0, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5ae0*=0, plFlavor=0x22b5ae4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc8, varVal2=0x0), pType=0x22b5ae0*=19, plFlavor=0x22b5ae4*=0) returned 0x0 [0228.967] IWbemClassObject:Get (in: This=0x6f33f0, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5ae0*=19, plFlavor=0x22b5ae4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc8, varVal2=0x0), pType=0x22b5ae0*=19, plFlavor=0x22b5ae4*=0) returned 0x0 [0228.967] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.967] IWbemClassObject:Get (in: This=0x6f33f0, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5be4*=0, plFlavor=0x22b5be8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x22b5be4*=8, plFlavor=0x22b5be8*=0) returned 0x0 [0228.968] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0228.968] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0228.968] IWbemClassObject:Get (in: This=0x6f33f0, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5be4*=8, plFlavor=0x22b5be8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x22b5be4*=8, plFlavor=0x22b5be8*=0) returned 0x0 [0228.968] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0228.968] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0228.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0228.968] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0228.968] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0228.969] IWbemClassObject:Get (in: This=0x6f33f0, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5d20*=0, plFlavor=0x22b5d24*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ", varVal2=0x0), pType=0x22b5d20*=8, plFlavor=0x22b5d24*=0) returned 0x0 [0228.969] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0228.969] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0229.033] IWbemClassObject:Get (in: This=0x6f33f0, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b5d20*=8, plFlavor=0x22b5d24*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ", varVal2=0x0), pType=0x22b5d20*=8, plFlavor=0x22b5d24*=0) returned 0x0 [0229.033] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0229.033] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0229.034] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0229.034] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f3720, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.216] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3720) returned 0x0 [0229.216] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.216] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.217] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.217] IUnknown:AddRef (This=0x6f3720) returned 0x3 [0229.217] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.217] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.217] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f3724) returned 0x0 [0229.217] IMarshal:GetUnmarshalClass (in: This=0x6f3724, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.217] IUnknown:Release (This=0x6f3724) returned 0x3 [0229.217] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.218] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.218] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.218] IUnknown:Release (This=0x6f3720) returned 0x2 [0229.218] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.218] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.218] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3720) returned 0x0 [0229.218] IUnknown:AddRef (This=0x6f3720) returned 0x4 [0229.218] IUnknown:Release (This=0x6f3720) returned 0x3 [0229.218] IUnknown:Release (This=0x6f3720) returned 0x2 [0229.218] CoTaskMemFree (pv=0x6a3eb8) [0229.218] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.218] IUnknown:AddRef (This=0x6f3720) returned 0x3 [0229.218] IWbemClassObject:Get (in: This=0x6f3720, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.219] IWbemClassObject:Get (in: This=0x6f3720, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.219] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0229.220] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0229.220] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.225] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.225] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.227] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0229.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f5190) returned 0x0 [0229.227] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0229.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f5190) returned 0x0 [0229.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.228] WbemDefPath:IUnknown:AddRef (This=0x6f5190) returned 0x3 [0229.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f15c8) returned 0x0 [0229.228] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f15c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.228] WbemDefPath:IUnknown:Release (This=0x6f15c8) returned 0x3 [0229.228] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.228] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.229] WbemDefPath:IUnknown:Release (This=0x6f5190) returned 0x2 [0229.229] WbemDefPath:IUnknown:Release (This=0x6f5190) returned 0x1 [0229.229] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.229] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5190, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f5190) returned 0x0 [0229.229] WbemDefPath:IUnknown:AddRef (This=0x6f5190) returned 0x3 [0229.229] WbemDefPath:IUnknown:Release (This=0x6f5190) returned 0x2 [0229.229] WbemDefPath:IWbemPath:SetText (This=0x6f5190, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.229] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.230] IWbemClassObject:Get (in: This=0x6f3720, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b6768*=0, plFlavor=0x22b676c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfd8, varVal2=0x0), pType=0x22b6768*=19, plFlavor=0x22b676c*=0) returned 0x0 [0229.230] IWbemClassObject:Get (in: This=0x6f3720, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b6768*=19, plFlavor=0x22b676c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfd8, varVal2=0x0), pType=0x22b6768*=19, plFlavor=0x22b676c*=0) returned 0x0 [0229.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.230] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.230] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.230] IWbemClassObject:Get (in: This=0x6f3720, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b686c*=0, plFlavor=0x22b6870*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x22b686c*=8, plFlavor=0x22b6870*=0) returned 0x0 [0229.230] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0229.231] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0229.231] IWbemClassObject:Get (in: This=0x6f3720, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b686c*=8, plFlavor=0x22b6870*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x22b686c*=8, plFlavor=0x22b6870*=0) returned 0x0 [0229.231] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0229.231] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0229.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.231] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.231] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.231] IWbemClassObject:Get (in: This=0x6f3720, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b69a8*=0, plFlavor=0x22b69ac*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ", varVal2=0x0), pType=0x22b69a8*=8, plFlavor=0x22b69ac*=0) returned 0x0 [0229.231] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0229.231] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0229.232] IWbemClassObject:Get (in: This=0x6f3720, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b69a8*=8, plFlavor=0x22b69ac*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ", varVal2=0x0), pType=0x22b69a8*=8, plFlavor=0x22b69ac*=0) returned 0x0 [0229.232] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0229.232] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0229.232] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0229.232] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f2730, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.246] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2730) returned 0x0 [0229.246] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.246] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.246] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.247] IUnknown:AddRef (This=0x6f2730) returned 0x3 [0229.247] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.247] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.247] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f2734) returned 0x0 [0229.247] IMarshal:GetUnmarshalClass (in: This=0x6f2734, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.247] IUnknown:Release (This=0x6f2734) returned 0x3 [0229.247] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.247] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.247] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.247] IUnknown:Release (This=0x6f2730) returned 0x2 [0229.247] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.248] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.248] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2730) returned 0x0 [0229.248] IUnknown:AddRef (This=0x6f2730) returned 0x4 [0229.248] IUnknown:Release (This=0x6f2730) returned 0x3 [0229.248] IUnknown:Release (This=0x6f2730) returned 0x2 [0229.248] CoTaskMemFree (pv=0x6a3eb8) [0229.248] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.248] IUnknown:AddRef (This=0x6f2730) returned 0x3 [0229.248] IWbemClassObject:Get (in: This=0x6f2730, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.248] IWbemClassObject:Get (in: This=0x6f2730, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.248] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0229.249] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0229.249] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.249] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.249] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.249] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.261] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0229.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.261] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4e80) returned 0x0 [0229.262] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4e80) returned 0x0 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.262] WbemDefPath:IUnknown:AddRef (This=0x6f4e80) returned 0x3 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f16a0) returned 0x0 [0229.262] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f16a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.262] WbemDefPath:IUnknown:Release (This=0x6f16a0) returned 0x3 [0229.262] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.263] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.263] WbemDefPath:IUnknown:Release (This=0x6f4e80) returned 0x2 [0229.263] WbemDefPath:IUnknown:Release (This=0x6f4e80) returned 0x1 [0229.263] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.263] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4e80, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4e80) returned 0x0 [0229.263] WbemDefPath:IUnknown:AddRef (This=0x6f4e80) returned 0x3 [0229.263] WbemDefPath:IUnknown:Release (This=0x6f4e80) returned 0x2 [0229.263] WbemDefPath:IWbemPath:SetText (This=0x6f4e80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x0 [0229.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.263] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.263] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.264] IWbemClassObject:Get (in: This=0x6f2730, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b73d4*=0, plFlavor=0x22b73d8*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe0, varVal2=0x0), pType=0x22b73d4*=19, plFlavor=0x22b73d8*=0) returned 0x0 [0229.264] IWbemClassObject:Get (in: This=0x6f2730, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b73d4*=19, plFlavor=0x22b73d8*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe0, varVal2=0x0), pType=0x22b73d4*=19, plFlavor=0x22b73d8*=0) returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.264] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.264] IWbemClassObject:Get (in: This=0x6f2730, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b74d8*=0, plFlavor=0x22b74dc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x22b74d8*=8, plFlavor=0x22b74dc*=0) returned 0x0 [0229.265] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0229.265] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0229.265] IWbemClassObject:Get (in: This=0x6f2730, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b74d8*=8, plFlavor=0x22b74dc*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x22b74d8*=8, plFlavor=0x22b74dc*=0) returned 0x0 [0229.265] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0229.265] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0229.265] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.265] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.265] IWbemClassObject:Get (in: This=0x6f2730, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7634*=0, plFlavor=0x22b7638*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ", varVal2=0x0), pType=0x22b7634*=8, plFlavor=0x22b7638*=0) returned 0x0 [0229.265] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0229.265] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0229.265] IWbemClassObject:Get (in: This=0x6f2730, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b7634*=8, plFlavor=0x22b7638*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ", varVal2=0x0), pType=0x22b7634*=8, plFlavor=0x22b7638*=0) returned 0x0 [0229.266] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0229.266] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0229.272] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0229.273] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f3d80, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.274] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3d80) returned 0x0 [0229.274] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.274] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.274] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.275] IUnknown:AddRef (This=0x6f3d80) returned 0x3 [0229.275] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.275] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.275] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f3d84) returned 0x0 [0229.275] IMarshal:GetUnmarshalClass (in: This=0x6f3d84, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.275] IUnknown:Release (This=0x6f3d84) returned 0x3 [0229.275] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.275] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.275] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.275] IUnknown:Release (This=0x6f3d80) returned 0x2 [0229.275] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.275] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.275] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3d80) returned 0x0 [0229.275] IUnknown:AddRef (This=0x6f3d80) returned 0x4 [0229.276] IUnknown:Release (This=0x6f3d80) returned 0x3 [0229.276] IUnknown:Release (This=0x6f3d80) returned 0x2 [0229.276] CoTaskMemFree (pv=0x6a3eb8) [0229.276] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.276] IUnknown:AddRef (This=0x6f3d80) returned 0x3 [0229.276] IWbemClassObject:Get (in: This=0x6f3d80, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.276] IWbemClassObject:Get (in: This=0x6f3d80, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.276] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0229.276] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0229.276] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.277] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.277] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.277] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.278] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.278] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f5040) returned 0x0 [0229.278] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f5040) returned 0x0 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.278] WbemDefPath:IUnknown:AddRef (This=0x6f5040) returned 0x3 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1a00) returned 0x0 [0229.279] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1a00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.279] WbemDefPath:IUnknown:Release (This=0x6f1a00) returned 0x3 [0229.279] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.279] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.279] WbemDefPath:IUnknown:Release (This=0x6f5040) returned 0x2 [0229.279] WbemDefPath:IUnknown:Release (This=0x6f5040) returned 0x1 [0229.279] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.279] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5040, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f5040) returned 0x0 [0229.279] WbemDefPath:IUnknown:AddRef (This=0x6f5040) returned 0x3 [0229.279] WbemDefPath:IUnknown:Release (This=0x6f5040) returned 0x2 [0229.279] WbemDefPath:IWbemPath:SetText (This=0x6f5040, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.280] IWbemClassObject:Get (in: This=0x6f3d80, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b80f8*=0, plFlavor=0x22b80fc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfec, varVal2=0x0), pType=0x22b80f8*=19, plFlavor=0x22b80fc*=0) returned 0x0 [0229.280] IWbemClassObject:Get (in: This=0x6f3d80, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b80f8*=19, plFlavor=0x22b80fc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfec, varVal2=0x0), pType=0x22b80f8*=19, plFlavor=0x22b80fc*=0) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.280] IWbemClassObject:Get (in: This=0x6f3d80, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b81fc*=0, plFlavor=0x22b8200*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x22b81fc*=8, plFlavor=0x22b8200*=0) returned 0x0 [0229.281] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0229.281] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0229.281] IWbemClassObject:Get (in: This=0x6f3d80, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b81fc*=8, plFlavor=0x22b8200*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x22b81fc*=8, plFlavor=0x22b8200*=0) returned 0x0 [0229.281] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0229.281] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0229.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.281] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.281] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.281] IWbemClassObject:Get (in: This=0x6f3d80, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8330*=0, plFlavor=0x22b8334*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ", varVal2=0x0), pType=0x22b8330*=8, plFlavor=0x22b8334*=0) returned 0x0 [0229.281] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0229.281] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0229.281] IWbemClassObject:Get (in: This=0x6f3d80, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8330*=8, plFlavor=0x22b8334*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ", varVal2=0x0), pType=0x22b8330*=8, plFlavor=0x22b8334*=0) returned 0x0 [0229.282] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0229.282] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0229.282] CoTaskMemAlloc (cb=0x4) returned 0x6a3eb8 [0229.282] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3eb8, puReturned=0x227e9dc | out: apObjects=0x6a3eb8*=0x6f3f18, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.286] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3f18) returned 0x0 [0229.286] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.286] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.286] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.287] IUnknown:AddRef (This=0x6f3f18) returned 0x3 [0229.287] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.287] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.287] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f3f1c) returned 0x0 [0229.287] IMarshal:GetUnmarshalClass (in: This=0x6f3f1c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.287] IUnknown:Release (This=0x6f3f1c) returned 0x3 [0229.287] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.287] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.287] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.287] IUnknown:Release (This=0x6f3f18) returned 0x2 [0229.287] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.287] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.287] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3f18) returned 0x0 [0229.287] IUnknown:AddRef (This=0x6f3f18) returned 0x4 [0229.287] IUnknown:Release (This=0x6f3f18) returned 0x3 [0229.288] IUnknown:Release (This=0x6f3f18) returned 0x2 [0229.288] CoTaskMemFree (pv=0x6a3eb8) [0229.288] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.288] IUnknown:AddRef (This=0x6f3f18) returned 0x3 [0229.288] IWbemClassObject:Get (in: This=0x6f3f18, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.288] IWbemClassObject:Get (in: This=0x6f3f18, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.288] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0229.288] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0229.288] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.288] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.288] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.288] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.289] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3eb8) returned 0x0 [0229.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3eb8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.289] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3eb8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4d30) returned 0x0 [0229.289] WbemDefPath:IUnknown:Release (This=0x6a3eb8) returned 0x0 [0229.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4d30) returned 0x0 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.290] WbemDefPath:IUnknown:AddRef (This=0x6f4d30) returned 0x3 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1880) returned 0x0 [0229.290] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1880, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.290] WbemDefPath:IUnknown:Release (This=0x6f1880) returned 0x3 [0229.290] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.290] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.291] WbemDefPath:IUnknown:Release (This=0x6f4d30) returned 0x2 [0229.291] WbemDefPath:IUnknown:Release (This=0x6f4d30) returned 0x1 [0229.291] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.291] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4d30, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4d30) returned 0x0 [0229.291] WbemDefPath:IUnknown:AddRef (This=0x6f4d30) returned 0x3 [0229.291] WbemDefPath:IUnknown:Release (This=0x6f4d30) returned 0x2 [0229.291] WbemDefPath:IWbemPath:SetText (This=0x6f4d30, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.291] IWbemClassObject:Get (in: This=0x6f3f18, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8d74*=0, plFlavor=0x22b8d78*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff8, varVal2=0x0), pType=0x22b8d74*=19, plFlavor=0x22b8d78*=0) returned 0x0 [0229.292] IWbemClassObject:Get (in: This=0x6f3f18, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8d74*=19, plFlavor=0x22b8d78*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff8, varVal2=0x0), pType=0x22b8d74*=19, plFlavor=0x22b8d78*=0) returned 0x0 [0229.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.292] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.292] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.292] IWbemClassObject:Get (in: This=0x6f3f18, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8e78*=0, plFlavor=0x22b8e7c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x22b8e78*=8, plFlavor=0x22b8e7c*=0) returned 0x0 [0229.292] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0229.292] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0229.292] IWbemClassObject:Get (in: This=0x6f3f18, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8e78*=8, plFlavor=0x22b8e7c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x22b8e78*=8, plFlavor=0x22b8e7c*=0) returned 0x0 [0229.292] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0229.292] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0229.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.293] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.293] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.293] IWbemClassObject:Get (in: This=0x6f3f18, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8fc4*=0, plFlavor=0x22b8fc8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ", varVal2=0x0), pType=0x22b8fc4*=8, plFlavor=0x22b8fc8*=0) returned 0x0 [0229.293] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0229.293] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0229.293] IWbemClassObject:Get (in: This=0x6f3f18, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b8fc4*=8, plFlavor=0x22b8fc8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ", varVal2=0x0), pType=0x22b8fc4*=8, plFlavor=0x22b8fc8*=0) returned 0x0 [0229.293] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0229.293] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0229.293] CoTaskMemAlloc (cb=0x4) returned 0x6a3ed8 [0229.294] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ed8, puReturned=0x227e9dc | out: apObjects=0x6a3ed8*=0x6f3588, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3588) returned 0x0 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.296] IUnknown:AddRef (This=0x6f3588) returned 0x3 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.296] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f358c) returned 0x0 [0229.297] IMarshal:GetUnmarshalClass (in: This=0x6f358c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.297] IUnknown:Release (This=0x6f358c) returned 0x3 [0229.297] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.298] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.298] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.302] IUnknown:Release (This=0x6f3588) returned 0x2 [0229.302] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.302] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.302] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3588) returned 0x0 [0229.302] IUnknown:AddRef (This=0x6f3588) returned 0x4 [0229.302] IUnknown:Release (This=0x6f3588) returned 0x3 [0229.302] IUnknown:Release (This=0x6f3588) returned 0x2 [0229.302] CoTaskMemFree (pv=0x6a3ed8) [0229.302] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.302] IUnknown:AddRef (This=0x6f3588) returned 0x3 [0229.302] IWbemClassObject:Get (in: This=0x6f3588, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.303] IWbemClassObject:Get (in: This=0x6f3588, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.303] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0229.303] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0229.303] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.303] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.303] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.303] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.304] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x6a3ed8) returned 0x0 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6a3ed8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.305] WbemDefPath:IClassFactory:CreateInstance (in: This=0x6a3ed8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f5270) returned 0x0 [0229.305] WbemDefPath:IUnknown:Release (This=0x6a3ed8) returned 0x0 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f5270) returned 0x0 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.305] WbemDefPath:IUnknown:AddRef (This=0x6f5270) returned 0x3 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.305] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1b80) returned 0x0 [0229.305] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1b80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.306] WbemDefPath:IUnknown:Release (This=0x6f1b80) returned 0x3 [0229.306] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.306] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.306] WbemDefPath:IUnknown:Release (This=0x6f5270) returned 0x2 [0229.306] WbemDefPath:IUnknown:Release (This=0x6f5270) returned 0x1 [0229.306] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.306] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.306] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5270, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f5270) returned 0x0 [0229.306] WbemDefPath:IUnknown:AddRef (This=0x6f5270) returned 0x3 [0229.306] WbemDefPath:IUnknown:Release (This=0x6f5270) returned 0x2 [0229.306] WbemDefPath:IWbemPath:SetText (This=0x6f5270, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x0 [0229.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.306] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.306] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.307] IWbemClassObject:Get (in: This=0x6f3588, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9a44*=0, plFlavor=0x22b9a48*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1cc, varVal2=0x0), pType=0x22b9a44*=19, plFlavor=0x22b9a48*=0) returned 0x0 [0229.307] IWbemClassObject:Get (in: This=0x6f3588, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9a44*=19, plFlavor=0x22b9a48*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1cc, varVal2=0x0), pType=0x22b9a44*=19, plFlavor=0x22b9a48*=0) returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.307] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.307] IWbemClassObject:Get (in: This=0x6f3588, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9b44*=0, plFlavor=0x22b9b48*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x22b9b44*=8, plFlavor=0x22b9b48*=0) returned 0x0 [0229.307] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0229.307] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0229.308] IWbemClassObject:Get (in: This=0x6f3588, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9b44*=8, plFlavor=0x22b9b48*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x22b9b44*=8, plFlavor=0x22b9b48*=0) returned 0x0 [0229.308] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0229.308] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0229.308] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.308] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.308] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.308] IWbemClassObject:Get (in: This=0x6f3588, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9ca0*=0, plFlavor=0x22b9ca4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ", varVal2=0x0), pType=0x22b9ca0*=8, plFlavor=0x22b9ca4*=0) returned 0x0 [0229.308] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0229.308] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0229.309] IWbemClassObject:Get (in: This=0x6f3588, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22b9ca0*=8, plFlavor=0x22b9ca4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ", varVal2=0x0), pType=0x22b9ca0*=8, plFlavor=0x22b9ca4*=0) returned 0x0 [0229.309] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0229.309] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0229.309] CoTaskMemAlloc (cb=0x4) returned 0x6a3ed8 [0229.309] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x6a3ed8, puReturned=0x227e9dc | out: apObjects=0x6a3ed8*=0x6f3a50, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.354] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f3a50) returned 0x0 [0229.354] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.354] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.354] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.355] IUnknown:AddRef (This=0x6f3a50) returned 0x3 [0229.355] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.355] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.355] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f3a54) returned 0x0 [0229.355] IMarshal:GetUnmarshalClass (in: This=0x6f3a54, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.355] IUnknown:Release (This=0x6f3a54) returned 0x3 [0229.355] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.355] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.355] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.355] IUnknown:Release (This=0x6f3a50) returned 0x2 [0229.355] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.355] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.355] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f3a50) returned 0x0 [0229.356] IUnknown:AddRef (This=0x6f3a50) returned 0x4 [0229.356] IUnknown:Release (This=0x6f3a50) returned 0x3 [0229.356] IUnknown:Release (This=0x6f3a50) returned 0x2 [0229.356] CoTaskMemFree (pv=0x6a3ed8) [0229.356] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.356] IUnknown:AddRef (This=0x6f3a50) returned 0x3 [0229.356] IWbemClassObject:Get (in: This=0x6f3a50, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.356] IWbemClassObject:Get (in: This=0x6f3a50, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.356] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0229.356] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0229.357] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.357] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.357] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.357] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.358] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x68f238) returned 0x0 [0229.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x68f238, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.358] WbemDefPath:IClassFactory:CreateInstance (in: This=0x68f238, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4c50) returned 0x0 [0229.358] WbemDefPath:IUnknown:Release (This=0x68f238) returned 0x0 [0229.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4c50) returned 0x0 [0229.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.359] WbemDefPath:IUnknown:AddRef (This=0x6f4c50) returned 0x3 [0229.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f1e68) returned 0x0 [0229.359] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f1e68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.359] WbemDefPath:IUnknown:Release (This=0x6f1e68) returned 0x3 [0229.359] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.359] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.359] WbemDefPath:IUnknown:Release (This=0x6f4c50) returned 0x2 [0229.359] WbemDefPath:IUnknown:Release (This=0x6f4c50) returned 0x1 [0229.359] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.360] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.360] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4c50, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4c50) returned 0x0 [0229.361] WbemDefPath:IUnknown:AddRef (This=0x6f4c50) returned 0x3 [0229.361] WbemDefPath:IUnknown:Release (This=0x6f4c50) returned 0x2 [0229.361] WbemDefPath:IWbemPath:SetText (This=0x6f4c50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.362] IWbemClassObject:Get (in: This=0x6f3a50, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba748*=0, plFlavor=0x22ba74c*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x110c, varVal2=0x0), pType=0x22ba748*=19, plFlavor=0x22ba74c*=0) returned 0x0 [0229.362] IWbemClassObject:Get (in: This=0x6f3a50, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba748*=19, plFlavor=0x22ba74c*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x110c, varVal2=0x0), pType=0x22ba748*=19, plFlavor=0x22ba74c*=0) returned 0x0 [0229.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.362] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.362] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.362] IWbemClassObject:Get (in: This=0x6f3a50, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba84c*=0, plFlavor=0x22ba850*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x22ba84c*=8, plFlavor=0x22ba850*=0) returned 0x0 [0229.362] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0229.362] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0229.363] IWbemClassObject:Get (in: This=0x6f3a50, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba84c*=8, plFlavor=0x22ba850*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x22ba84c*=8, plFlavor=0x22ba850*=0) returned 0x0 [0229.363] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0229.363] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0229.363] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.363] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.363] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.363] IWbemClassObject:Get (in: This=0x6f3a50, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba990*=0, plFlavor=0x22ba994*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x22ba990*=8, plFlavor=0x22ba994*=0) returned 0x0 [0229.363] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0229.363] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0229.363] IWbemClassObject:Get (in: This=0x6f3a50, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22ba990*=8, plFlavor=0x22ba994*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x22ba990*=8, plFlavor=0x22ba994*=0) returned 0x0 [0229.364] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0229.364] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0229.364] CoTaskMemAlloc (cb=0x4) returned 0x68f238 [0229.364] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x68f238, puReturned=0x227e9dc | out: apObjects=0x68f238*=0x6f2f28, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.366] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2f28) returned 0x0 [0229.366] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.366] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.366] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.367] IUnknown:AddRef (This=0x6f2f28) returned 0x3 [0229.367] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.367] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.367] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f2f2c) returned 0x0 [0229.367] IMarshal:GetUnmarshalClass (in: This=0x6f2f2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.367] IUnknown:Release (This=0x6f2f2c) returned 0x3 [0229.367] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.367] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.367] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.367] IUnknown:Release (This=0x6f2f28) returned 0x2 [0229.368] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.368] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.368] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2f28) returned 0x0 [0229.368] IUnknown:AddRef (This=0x6f2f28) returned 0x4 [0229.368] IUnknown:Release (This=0x6f2f28) returned 0x3 [0229.368] IUnknown:Release (This=0x6f2f28) returned 0x2 [0229.368] CoTaskMemFree (pv=0x68f238) [0229.368] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.368] IUnknown:AddRef (This=0x6f2f28) returned 0x3 [0229.368] IWbemClassObject:Get (in: This=0x6f2f28, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.368] IWbemClassObject:Get (in: This=0x6f2f28, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4860\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.368] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4860\"") returned 0x5e [0229.369] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4860\"") returned 0x5e [0229.369] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.369] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.369] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.369] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.370] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x68f238) returned 0x0 [0229.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x68f238, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.370] WbemDefPath:IClassFactory:CreateInstance (in: This=0x68f238, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4f60) returned 0x0 [0229.370] WbemDefPath:IUnknown:Release (This=0x68f238) returned 0x0 [0229.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4f60) returned 0x0 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.371] WbemDefPath:IUnknown:AddRef (This=0x6f4f60) returned 0x3 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0290) returned 0x0 [0229.371] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0290, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.371] WbemDefPath:IUnknown:Release (This=0x6f0290) returned 0x3 [0229.371] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.371] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.372] WbemDefPath:IUnknown:Release (This=0x6f4f60) returned 0x2 [0229.372] WbemDefPath:IUnknown:Release (This=0x6f4f60) returned 0x1 [0229.372] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.372] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.372] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4f60, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4f60) returned 0x0 [0229.372] WbemDefPath:IUnknown:AddRef (This=0x6f4f60) returned 0x3 [0229.372] WbemDefPath:IUnknown:Release (This=0x6f4f60) returned 0x2 [0229.372] WbemDefPath:IWbemPath:SetText (This=0x6f4f60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4860\"") returned 0x0 [0229.372] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.372] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.373] IWbemClassObject:Get (in: This=0x6f2f28, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb4e0*=0, plFlavor=0x22bb4e4*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12fc, varVal2=0x0), pType=0x22bb4e0*=19, plFlavor=0x22bb4e4*=0) returned 0x0 [0229.373] IWbemClassObject:Get (in: This=0x6f2f28, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb4e0*=19, plFlavor=0x22bb4e4*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12fc, varVal2=0x0), pType=0x22bb4e0*=19, plFlavor=0x22bb4e4*=0) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.373] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.374] IWbemClassObject:Get (in: This=0x6f2f28, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb5e4*=0, plFlavor=0x22bb5e8*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="msfeedssync.exe", varVal2=0x0), pType=0x22bb5e4*=8, plFlavor=0x22bb5e8*=0) returned 0x0 [0229.374] SysStringByteLen (bstr="msfeedssync.exe") returned 0x1e [0229.374] SysStringByteLen (bstr="msfeedssync.exe") returned 0x1e [0229.374] IWbemClassObject:Get (in: This=0x6f2f28, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb5e4*=8, plFlavor=0x22bb5e8*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="msfeedssync.exe", varVal2=0x0), pType=0x22bb5e4*=8, plFlavor=0x22bb5e8*=0) returned 0x0 [0229.374] SysStringByteLen (bstr="msfeedssync.exe") returned 0x1e [0229.374] SysStringByteLen (bstr="msfeedssync.exe") returned 0x1e [0229.374] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.374] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.374] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.374] IWbemClassObject:Get (in: This=0x6f2f28, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb730*=0, plFlavor=0x22bb734*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\msfeedssync.exe sync", varVal2=0x0), pType=0x22bb730*=8, plFlavor=0x22bb734*=0) returned 0x0 [0229.375] SysStringByteLen (bstr="C:\\Windows\\system32\\msfeedssync.exe sync") returned 0x50 [0229.375] SysStringByteLen (bstr="C:\\Windows\\system32\\msfeedssync.exe sync") returned 0x50 [0229.375] IWbemClassObject:Get (in: This=0x6f2f28, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bb730*=8, plFlavor=0x22bb734*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\msfeedssync.exe sync", varVal2=0x0), pType=0x22bb730*=8, plFlavor=0x22bb734*=0) returned 0x0 [0229.375] SysStringByteLen (bstr="C:\\Windows\\system32\\msfeedssync.exe sync") returned 0x50 [0229.376] SysStringByteLen (bstr="C:\\Windows\\system32\\msfeedssync.exe sync") returned 0x50 [0229.376] CoTaskMemAlloc (cb=0x4) returned 0x68f238 [0229.376] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x68f238, puReturned=0x227e9dc | out: apObjects=0x68f238*=0x6f2268, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2268) returned 0x0 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.379] IUnknown:AddRef (This=0x6f2268) returned 0x3 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.379] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f226c) returned 0x0 [0229.379] IMarshal:GetUnmarshalClass (in: This=0x6f226c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.380] IUnknown:Release (This=0x6f226c) returned 0x3 [0229.380] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.380] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.380] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.380] IUnknown:Release (This=0x6f2268) returned 0x2 [0229.380] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.380] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.380] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2268) returned 0x0 [0229.380] IUnknown:AddRef (This=0x6f2268) returned 0x4 [0229.380] IUnknown:Release (This=0x6f2268) returned 0x3 [0229.380] IUnknown:Release (This=0x6f2268) returned 0x2 [0229.380] CoTaskMemFree (pv=0x68f238) [0229.380] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.381] IUnknown:AddRef (This=0x6f2268) returned 0x3 [0229.381] IWbemClassObject:Get (in: This=0x6f2268, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.381] IWbemClassObject:Get (in: This=0x6f2268, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.381] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x5e [0229.381] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x5e [0229.381] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.381] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.381] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.382] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.383] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x68f238) returned 0x0 [0229.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x68f238, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x68f238, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f4ef0) returned 0x0 [0229.383] WbemDefPath:IUnknown:Release (This=0x68f238) returned 0x0 [0229.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f4ef0) returned 0x0 [0229.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.384] WbemDefPath:IUnknown:AddRef (This=0x6f4ef0) returned 0x3 [0229.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0230) returned 0x0 [0229.384] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0230, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.384] WbemDefPath:IUnknown:Release (This=0x6f0230) returned 0x3 [0229.384] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.384] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.384] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.384] WbemDefPath:IUnknown:Release (This=0x6f4ef0) returned 0x2 [0229.384] WbemDefPath:IUnknown:Release (This=0x6f4ef0) returned 0x1 [0229.384] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.384] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.385] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4ef0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f4ef0) returned 0x0 [0229.385] WbemDefPath:IUnknown:AddRef (This=0x6f4ef0) returned 0x3 [0229.385] WbemDefPath:IUnknown:Release (This=0x6f4ef0) returned 0x2 [0229.385] WbemDefPath:IWbemPath:SetText (This=0x6f4ef0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x0 [0229.385] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.385] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.385] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.386] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.386] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.386] IWbemClassObject:Get (in: This=0x6f2268, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc150*=0, plFlavor=0x22bc154*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1068, varVal2=0x0), pType=0x22bc150*=19, plFlavor=0x22bc154*=0) returned 0x0 [0229.386] IWbemClassObject:Get (in: This=0x6f2268, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc150*=19, plFlavor=0x22bc154*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1068, varVal2=0x0), pType=0x22bc150*=19, plFlavor=0x22bc154*=0) returned 0x0 [0229.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.387] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.387] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.387] IWbemClassObject:Get (in: This=0x6f2268, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc254*=0, plFlavor=0x22bc258*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x22bc254*=8, plFlavor=0x22bc258*=0) returned 0x0 [0229.387] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0229.387] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0229.387] IWbemClassObject:Get (in: This=0x6f2268, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc254*=8, plFlavor=0x22bc258*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x22bc254*=8, plFlavor=0x22bc258*=0) returned 0x0 [0229.387] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0229.387] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0229.387] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.387] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.387] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.388] IWbemClassObject:Get (in: This=0x6f2268, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc3c0*=0, plFlavor=0x22bc3c4*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca", varVal2=0x0), pType=0x22bc3c0*=8, plFlavor=0x22bc3c4*=0) returned 0x0 [0229.388] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca") returned 0xd6 [0229.388] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca") returned 0xd6 [0229.388] IWbemClassObject:Get (in: This=0x6f2268, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bc3c0*=8, plFlavor=0x22bc3c4*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca", varVal2=0x0), pType=0x22bc3c0*=8, plFlavor=0x22bc3c4*=0) returned 0x0 [0229.388] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca") returned 0xd6 [0229.388] SysStringByteLen (bstr="\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca") returned 0xd6 [0229.388] CoTaskMemAlloc (cb=0x4) returned 0x68f238 [0229.388] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x68f238, puReturned=0x227e9dc | out: apObjects=0x68f238*=0x6f2400, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2400) returned 0x0 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.397] IUnknown:AddRef (This=0x6f2400) returned 0x3 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.397] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.398] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f2404) returned 0x0 [0229.398] IMarshal:GetUnmarshalClass (in: This=0x6f2404, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.398] IUnknown:Release (This=0x6f2404) returned 0x3 [0229.398] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.398] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.398] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.398] IUnknown:Release (This=0x6f2400) returned 0x2 [0229.398] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.398] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.398] IUnknown:QueryInterface (in: This=0x6f2400, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2400) returned 0x0 [0229.398] IUnknown:AddRef (This=0x6f2400) returned 0x4 [0229.398] IUnknown:Release (This=0x6f2400) returned 0x3 [0229.398] IUnknown:Release (This=0x6f2400) returned 0x2 [0229.398] CoTaskMemFree (pv=0x68f238) [0229.398] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.399] IUnknown:AddRef (This=0x6f2400) returned 0x3 [0229.399] IWbemClassObject:Get (in: This=0x6f2400, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.399] IWbemClassObject:Get (in: This=0x6f2400, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.399] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0229.399] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0229.399] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.399] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.399] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.400] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.401] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x68f238) returned 0x0 [0229.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x68f238, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.401] WbemDefPath:IClassFactory:CreateInstance (in: This=0x68f238, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f52e0) returned 0x0 [0229.401] WbemDefPath:IUnknown:Release (This=0x68f238) returned 0x0 [0229.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f52e0) returned 0x0 [0229.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.402] WbemDefPath:IUnknown:AddRef (This=0x6f52e0) returned 0x3 [0229.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0488) returned 0x0 [0229.402] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0488, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.402] WbemDefPath:IUnknown:Release (This=0x6f0488) returned 0x3 [0229.402] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.402] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.402] WbemDefPath:IUnknown:Release (This=0x6f52e0) returned 0x2 [0229.402] WbemDefPath:IUnknown:Release (This=0x6f52e0) returned 0x1 [0229.402] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.402] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f52e0, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f52e0) returned 0x0 [0229.402] WbemDefPath:IUnknown:AddRef (This=0x6f52e0) returned 0x3 [0229.402] WbemDefPath:IUnknown:Release (This=0x6f52e0) returned 0x2 [0229.403] WbemDefPath:IWbemPath:SetText (This=0x6f52e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.403] IWbemClassObject:Get (in: This=0x6f2400, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcf7c*=0, plFlavor=0x22bcf80*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1224, varVal2=0x0), pType=0x22bcf7c*=19, plFlavor=0x22bcf80*=0) returned 0x0 [0229.403] IWbemClassObject:Get (in: This=0x6f2400, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bcf7c*=19, plFlavor=0x22bcf80*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1224, varVal2=0x0), pType=0x22bcf7c*=19, plFlavor=0x22bcf80*=0) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.403] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.403] IWbemClassObject:Get (in: This=0x6f2400, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd080*=0, plFlavor=0x22bd084*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x22bd080*=8, plFlavor=0x22bd084*=0) returned 0x0 [0229.403] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0229.404] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0229.404] IWbemClassObject:Get (in: This=0x6f2400, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd080*=8, plFlavor=0x22bd084*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x22bd080*=8, plFlavor=0x22bd084*=0) returned 0x0 [0229.404] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0229.404] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0229.404] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.404] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.404] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.404] IWbemClassObject:Get (in: This=0x6f2400, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd1bc*=0, plFlavor=0x22bd1c0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\??\\C:\\Windows\\system32\\conhost.exe 0x4", varVal2=0x0), pType=0x22bd1bc*=8, plFlavor=0x22bd1c0*=0) returned 0x0 [0229.404] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0229.404] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0229.405] IWbemClassObject:Get (in: This=0x6f2400, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bd1bc*=8, plFlavor=0x22bd1c0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\??\\C:\\Windows\\system32\\conhost.exe 0x4", varVal2=0x0), pType=0x22bd1bc*=8, plFlavor=0x22bd1c0*=0) returned 0x0 [0229.405] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0229.405] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0229.405] CoTaskMemAlloc (cb=0x4) returned 0x68f238 [0229.405] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x68f238, puReturned=0x227e9dc | out: apObjects=0x68f238*=0x6f2598, puReturned=0x227e9dc*=0x1) returned 0x0 [0229.407] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e248 | out: ppvObject=0x18e248*=0x6f2598) returned 0x0 [0229.407] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0229.407] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e024 | out: ppvObject=0x18e024*=0x0) returned 0x80004002 [0229.407] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddfc | out: ppvObject=0x18ddfc*=0x0) returned 0x80004002 [0229.408] IUnknown:AddRef (This=0x6f2598) returned 0x3 [0229.408] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db5c | out: ppvObject=0x18db5c*=0x0) returned 0x80004002 [0229.408] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0229.408] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db18 | out: ppvObject=0x18db18*=0x6f259c) returned 0x0 [0229.408] IMarshal:GetUnmarshalClass (in: This=0x6f259c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db20 | out: pCid=0x18db20*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0229.408] IUnknown:Release (This=0x6f259c) returned 0x3 [0229.408] CoGetContextToken (in: pToken=0x18db78 | out: pToken=0x18db78) returned 0x0 [0229.409] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0229.409] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e00c | out: ppvObject=0x18e00c*=0x0) returned 0x80004002 [0229.409] IUnknown:Release (This=0x6f2598) returned 0x2 [0229.409] CoGetContextToken (in: pToken=0x18e558 | out: pToken=0x18e558) returned 0x0 [0229.409] CoGetContextToken (in: pToken=0x18e4b8 | out: pToken=0x18e4b8) returned 0x0 [0229.409] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x18e588*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x6f2598) returned 0x0 [0229.409] IUnknown:AddRef (This=0x6f2598) returned 0x4 [0229.409] IUnknown:Release (This=0x6f2598) returned 0x3 [0229.409] IUnknown:Release (This=0x6f2598) returned 0x2 [0229.409] CoTaskMemFree (pv=0x68f238) [0229.409] CoGetContextToken (in: pToken=0x18e8d0 | out: pToken=0x18e8d0) returned 0x0 [0229.409] IUnknown:AddRef (This=0x6f2598) returned 0x3 [0229.409] IWbemClassObject:Get (in: This=0x6f2598, wszName="__GENUS", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec60*=0, plFlavor=0x18ec5c*=0 | out: pVal=0x18ebe0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec60*=3, plFlavor=0x18ec5c*=64) returned 0x0 [0229.409] IWbemClassObject:Get (in: This=0x6f2598, wszName="__PATH", lFlags=0, pVal=0x18ebc4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec48*=0, plFlavor=0x18ec44*=0 | out: pVal=0x18ebc4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"", varVal2=0x0), pType=0x18ec48*=8, plFlavor=0x18ec44*=64) returned 0x0 [0229.410] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0229.410] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0229.410] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebf0 | out: ppv=0x18ebf0*=0x692bc4) returned 0x0 [0229.410] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe8 | out: pAptType=0x18ebe8*=1) returned 0x0 [0229.410] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebec | out: ppvObject=0x18ebec*=0x0) returned 0x80004002 [0229.410] IUnknown:Release (This=0x692bc4) returned 0x1 [0229.411] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e558 | out: ppv=0x18e558*=0x68f238) returned 0x0 [0229.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x68f238, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e774 | out: ppvObject=0x18e774*=0x0) returned 0x80004002 [0229.411] WbemDefPath:IClassFactory:CreateInstance (in: This=0x68f238, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e780 | out: ppvObject=0x18e780*=0x6f5580) returned 0x0 [0229.411] WbemDefPath:IUnknown:Release (This=0x68f238) returned 0x0 [0229.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x6f5580) returned 0x0 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e360 | out: ppvObject=0x18e360*=0x0) returned 0x80004002 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df54 | out: ppvObject=0x18df54*=0x0) returned 0x80004002 [0229.412] WbemDefPath:IUnknown:AddRef (This=0x6f5580) returned 0x3 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcb4 | out: ppvObject=0x18dcb4*=0x0) returned 0x80004002 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc70 | out: ppvObject=0x18dc70*=0x6f0410) returned 0x0 [0229.412] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6f0410, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc78 | out: pCid=0x18dc78*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0229.412] WbemDefPath:IUnknown:Release (This=0x6f0410) returned 0x3 [0229.412] CoGetContextToken (in: pToken=0x18dcd0 | out: pToken=0x18dcd0) returned 0x0 [0229.412] CoGetContextToken (in: pToken=0x18e0d8 | out: pToken=0x18e0d8) returned 0x0 [0229.412] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0229.413] WbemDefPath:IUnknown:Release (This=0x6f5580) returned 0x2 [0229.413] WbemDefPath:IUnknown:Release (This=0x6f5580) returned 0x1 [0229.413] CoGetContextToken (in: pToken=0x18ea68 | out: pToken=0x18ea68) returned 0x0 [0229.413] CoGetContextToken (in: pToken=0x18e9c8 | out: pToken=0x18e9c8) returned 0x0 [0229.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5580, riid=0x18ea98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6f5580) returned 0x0 [0229.413] WbemDefPath:IUnknown:AddRef (This=0x6f5580) returned 0x3 [0229.413] WbemDefPath:IUnknown:Release (This=0x6f5580) returned 0x2 [0229.413] WbemDefPath:IWbemPath:SetText (This=0x6f5580, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.413] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.413] IWbemClassObject:Get (in: This=0x6f2598, wszName="ProcessId", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bdbc8*=0, plFlavor=0x22bdbcc*=0 | out: pVal=0x18ebe4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xad0, varVal2=0x0), pType=0x22bdbc8*=19, plFlavor=0x22bdbcc*=0) returned 0x0 [0229.413] IWbemClassObject:Get (in: This=0x6f2598, wszName="ProcessId", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bdbc8*=19, plFlavor=0x22bdbcc*=0 | out: pVal=0x18ebec*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xad0, varVal2=0x0), pType=0x22bdbc8*=19, plFlavor=0x22bdbcc*=0) returned 0x0 [0229.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.414] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.414] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.414] IWbemClassObject:Get (in: This=0x6f2598, wszName="Name", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bdccc*=0, plFlavor=0x22bdcd0*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x22bdccc*=8, plFlavor=0x22bdcd0*=0) returned 0x0 [0229.414] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0229.414] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0229.414] IWbemClassObject:Get (in: This=0x6f2598, wszName="Name", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bdccc*=8, plFlavor=0x22bdcd0*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x22bdccc*=8, plFlavor=0x22bdcd0*=0) returned 0x0 [0229.414] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0229.414] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0229.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0229.414] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0229.414] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0229.414] IWbemClassObject:Get (in: This=0x6f2598, wszName="CommandLine", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bde08*=0, plFlavor=0x22bde0c*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"", varVal2=0x0), pType=0x22bde08*=8, plFlavor=0x22bde0c*=0) returned 0x0 [0229.415] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0229.415] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0229.415] IWbemClassObject:Get (in: This=0x6f2598, wszName="CommandLine", lFlags=0, pVal=0x18ebec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x22bde08*=8, plFlavor=0x22bde0c*=0 | out: pVal=0x18ebec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"", varVal2=0x0), pType=0x22bde08*=8, plFlavor=0x22bde0c*=0) returned 0x0 [0229.415] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0229.415] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0229.415] CoTaskMemAlloc (cb=0x4) returned 0x68f238 [0229.415] IEnumWbemClassObject:Next (in: This=0x6bd0e0, lTimeout=-1, uCount=0x1, apObjects=0x68f238, puReturned=0x227e9dc | out: apObjects=0x68f238*=0x0, puReturned=0x227e9dc*=0x0) returned 0x1 [0229.420] CoTaskMemFree (pv=0x68f238) [0229.422] CoGetContextToken (in: pToken=0x18eb10 | out: pToken=0x18eb10) returned 0x0 [0229.422] WbemLocator:IUnknown:Release (This=0x6c1968) returned 0x1 [0229.422] IUnknown:Release (This=0x6bd0e0) returned 0x0 [0229.426] CoGetContextToken (in: pToken=0x18eb10 | out: pToken=0x18eb10) returned 0x0 [0229.426] WbemLocator:IUnknown:Release (This=0x6bfa00) returned 0x1 [0229.426] IUnknown:Release (This=0x6bacd0) returned 0x0 [0231.868] GetACP () returned 0x4e4 [0232.336] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x105, lpBuffer=0x18e540, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0233.096] GetCurrentProcess () returned 0xffffffff [0233.096] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e8a0 | out: TokenHandle=0x18e8a0*=0x310) returned 1 [0233.114] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0233.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0233.123] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18e898 | out: lpFileInformation=0x18e898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0233.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0233.125] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0233.130] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x18e8a0 | out: lpFileInformation=0x18e8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0233.132] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0233.133] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0233.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e7d8) returned 1 [0233.134] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x314 [0233.135] GetFileType (hFile=0x314) returned 0x1 [0233.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e7d4) returned 1 [0233.135] GetFileType (hFile=0x314) returned 0x1 [0233.201] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e824 | out: phkResult=0x18e824*=0x0) returned 0x2 [0233.202] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e824 | out: phkResult=0x18e824*=0x0) returned 0x2 [0233.206] GetFileSize (in: hFile=0x314, lpFileSizeHigh=0x18e894 | out: lpFileSizeHigh=0x18e894*=0x0) returned 0x8c8f [0233.208] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e850, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e850*=0x1000, lpOverlapped=0x0) returned 1 [0233.253] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e700, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e700*=0x1000, lpOverlapped=0x0) returned 1 [0233.261] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e5b4, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e5b4*=0x1000, lpOverlapped=0x0) returned 1 [0233.263] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e5b4, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e5b4*=0x1000, lpOverlapped=0x0) returned 1 [0233.264] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e5b4, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e5b4*=0x1000, lpOverlapped=0x0) returned 1 [0233.265] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e4ec, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e4ec*=0x1000, lpOverlapped=0x0) returned 1 [0233.274] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e66c, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e66c*=0x1000, lpOverlapped=0x0) returned 1 [0233.279] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e57c, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e57c*=0x1000, lpOverlapped=0x0) returned 1 [0233.279] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e57c, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e57c*=0xc8f, lpOverlapped=0x0) returned 1 [0233.280] ReadFile (in: hFile=0x314, lpBuffer=0x22c3db8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e63c, lpOverlapped=0x0 | out: lpBuffer=0x22c3db8*, lpNumberOfBytesRead=0x18e63c*=0x0, lpOverlapped=0x0) returned 1 [0233.280] CloseHandle (hObject=0x314) returned 1 [0233.284] GetCurrentProcess () returned 0xffffffff [0233.284] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9e4 | out: TokenHandle=0x18e9e4*=0x314) returned 1 [0233.286] GetCurrentProcess () returned 0xffffffff [0233.286] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9e4 | out: TokenHandle=0x18e9e4*=0x318) returned 1 [0233.288] GetCurrentProcess () returned 0xffffffff [0233.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e8a0 | out: TokenHandle=0x18e8a0*=0x31c) returned 1 [0233.288] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18e898 | out: lpFileInformation=0x18e898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611edffd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x611edffd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0233.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0233.288] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x41, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0233.289] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x18e8a0 | out: lpFileInformation=0x18e8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611edffd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x611edffd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6c6)) returned 1 [0233.289] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0233.289] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", nBufferLength=0x41, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config", lpFilePart=0x0) returned 0x40 [0233.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18e7d8) returned 1 [0233.289] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x320 [0233.290] GetFileType (hFile=0x320) returned 0x1 [0233.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e7d4) returned 1 [0233.290] GetFileType (hFile=0x320) returned 0x1 [0233.290] GetFileSize (in: hFile=0x320, lpFileSizeHigh=0x18e894 | out: lpFileSizeHigh=0x18e894*=0x0) returned 0x6c6 [0233.291] ReadFile (in: hFile=0x320, lpBuffer=0x22dd294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e850, lpOverlapped=0x0 | out: lpBuffer=0x22dd294*, lpNumberOfBytesRead=0x18e850*=0x6c6, lpOverlapped=0x0) returned 1 [0233.296] ReadFile (in: hFile=0x320, lpBuffer=0x22dd294, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18e728, lpOverlapped=0x0 | out: lpBuffer=0x22dd294*, lpNumberOfBytesRead=0x18e728*=0x0, lpOverlapped=0x0) returned 1 [0233.296] CloseHandle (hObject=0x320) returned 1 [0233.297] GetCurrentProcess () returned 0xffffffff [0233.297] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9e4 | out: TokenHandle=0x18e9e4*=0x320) returned 1 [0233.298] GetCurrentProcess () returned 0xffffffff [0233.298] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e9e4 | out: TokenHandle=0x18e9e4*=0x324) returned 1 [0233.327] GetCurrentProcess () returned 0xffffffff [0233.327] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e844 | out: TokenHandle=0x18e844*=0x328) returned 1 [0233.386] GetCurrentProcess () returned 0xffffffff [0233.386] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e854 | out: TokenHandle=0x18e854*=0x32c) returned 1 [0233.555] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x330 [0233.556] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x334 [0233.574] GetCurrentProcess () returned 0xffffffff [0233.574] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e838 | out: TokenHandle=0x18e838*=0x338) returned 1 [0233.582] GetCurrentProcess () returned 0xffffffff [0233.583] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e848 | out: TokenHandle=0x18e848*=0x33c) returned 1 [0233.588] QueryPerformanceFrequency (in: lpFrequency=0x646908 | out: lpFrequency=0x646908*=100000000) returned 1 [0233.589] QueryPerformanceCounter (in: lpPerformanceCount=0x18ebbc | out: lpPerformanceCount=0x18ebbc*=1820746760108) returned 1 [0233.599] GetCurrentProcess () returned 0xffffffff [0233.599] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e804 | out: TokenHandle=0x18e804*=0x340) returned 1 [0233.608] GetCurrentProcess () returned 0xffffffff [0233.608] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e814 | out: TokenHandle=0x18e814*=0x344) returned 1 [0233.648] GetCurrentProcess () returned 0xffffffff [0233.648] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e818 | out: TokenHandle=0x18e818*=0x348) returned 1 [0233.653] GetCurrentProcess () returned 0xffffffff [0233.653] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e828 | out: TokenHandle=0x18e828*=0x34c) returned 1 [0233.664] GetCurrentProcess () returned 0xffffffff [0233.664] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18eaa0 | out: TokenHandle=0x18eaa0*=0x350) returned 1 [0233.680] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18dbdc | out: phkResult=0x18dbdc*=0x354) returned 0x0 [0233.681] RegQueryValueExW (in: hKey=0x354, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18dbfc, lpData=0x0, lpcbData=0x18dbf8*=0x0 | out: lpType=0x18dbfc*=0x1, lpData=0x0, lpcbData=0x18dbf8*=0xe) returned 0x0 [0233.681] RegQueryValueExW (in: hKey=0x354, lpValueName="InstallationType", lpReserved=0x0, lpType=0x18dbfc, lpData=0x22e9010, lpcbData=0x18dbf8*=0xe | out: lpType=0x18dbfc*=0x1, lpData="Client", lpcbData=0x18dbf8*=0xe) returned 0x0 [0233.681] RegCloseKey (hKey=0x354) returned 0x0 [0233.775] CoTaskMemAlloc (cb=0xcc0) returned 0x721dd8 [0233.775] RasEnumConnectionsW (in: param_1=0x721dd8, param_2=0x18eab0, param_3=0x18eab4 | out: param_1=0x721dd8, param_2=0x18eab0, param_3=0x18eab4) returned 0x0 [0233.815] CoTaskMemFree (pv=0x721dd8) [0233.828] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18e898 | out: lpWSAData=0x18e898) returned 0 [0233.867] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3a0 [0233.898] setsockopt (s=0x3a0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0233.898] closesocket (s=0x3a0) returned 0 [0233.899] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3a0 [0233.901] setsockopt (s=0x3a0, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0233.901] closesocket (s=0x3a0) returned 0 [0233.902] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3a0 [0233.903] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3a4 [0233.904] ioctlsocket (in: s=0x3a0, cmd=-2147195266, argp=0x18eab8 | out: argp=0x18eab8) returned 0 [0233.904] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3a8 [0233.905] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ac [0233.905] ioctlsocket (in: s=0x3a8, cmd=-2147195266, argp=0x18eab8 | out: argp=0x18eab8) returned 0 [0233.906] WSAIoctl (in: s=0x3a0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18eaa0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18eaa0, lpOverlapped=0x0) returned -1 [0233.911] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e7d0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0233.926] WSAEventSelect (s=0x3a0, hEventObject=0x3a4, lNetworkEvents=512) returned 0 [0233.926] WSAIoctl (in: s=0x3a8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18eaa0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18eaa0, lpOverlapped=0x0) returned -1 [0233.927] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e7d0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0233.927] WSAEventSelect (s=0x3a8, hEventObject=0x3ac, lNetworkEvents=512) returned 0 [0233.927] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3b4 [0233.928] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3b4, param_3=0x3) returned 0x0 [0233.946] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x18eacc | out: phkResult=0x18eacc*=0x3cc) returned 0x0 [0233.948] RegOpenKeyExW (in: hKey=0x3cc, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ea80 | out: phkResult=0x18ea80*=0x3d0) returned 0x0 [0233.948] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3d4 [0233.949] RegNotifyChangeKeyValue (hKey=0x3d0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3d4, fAsynchronous=1) returned 0x0 [0233.951] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ea84 | out: phkResult=0x18ea84*=0x3d8) returned 0x0 [0233.952] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3dc [0233.952] RegNotifyChangeKeyValue (hKey=0x3d8, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3dc, fAsynchronous=1) returned 0x0 [0233.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ea84 | out: phkResult=0x18ea84*=0x3e0) returned 0x0 [0233.953] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e4 [0233.953] RegNotifyChangeKeyValue (hKey=0x3e0, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x3e4, fAsynchronous=1) returned 0x0 [0233.954] GetCurrentProcess () returned 0xffffffff [0233.954] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18ea74 | out: TokenHandle=0x18ea74*=0x3e8) returned 1 [0233.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e378 | out: phkResult=0x18e378*=0x3ec) returned 0x0 [0233.963] RegQueryValueExW (in: hKey=0x3ec, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x18e394, lpData=0x0, lpcbData=0x18e390*=0x0 | out: lpType=0x18e394*=0x0, lpData=0x0, lpcbData=0x18e390*=0x0) returned 0x2 [0233.963] RegCloseKey (hKey=0x3ec) returned 0x0 [0234.000] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x727dc0 [0234.034] WinHttpSetTimeouts (hInternet=0x727dc0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0234.036] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x18ea80 | out: pProxyConfig=0x18ea80) returned 1 [0234.121] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x18e2f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0234.121] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x18e2f0, nSize=0x80 | out: lpBuffer="") returned 0x0 [0234.138] EtwEventRegister (in: ProviderId=0x22ebe04, EnableCallback=0x46e05e6, CallbackContext=0x0, RegHandle=0x22ebde0 | out: RegHandle=0x22ebde0) returned 0x0 [0234.150] EtwEventSetInformation (RegHandle=0x6b7570, InformationClass=0x36, EventInformation=0x2, InformationLength=0x22ebda0) returned 0x0 [0234.156] GetCurrentProcess () returned 0xffffffff [0234.156] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e7e0 | out: TokenHandle=0x18e7e0*=0x434) returned 1 [0234.161] GetCurrentProcess () returned 0xffffffff [0234.161] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e7f0 | out: TokenHandle=0x18e7f0*=0x440) returned 1 [0234.167] EtwEventRegister (in: ProviderId=0x22ed3b8, EnableCallback=0x46e060e, CallbackContext=0x0, RegHandle=0x22ed394 | out: RegHandle=0x22ed394) returned 0x0 [0234.167] EtwEventSetInformation (RegHandle=0x6b77e0, InformationClass=0x37, EventInformation=0x2, InformationLength=0x22ed358) returned 0x0 [0234.177] SetEvent (hEvent=0x330) returned 1 [0234.215] GetCurrentProcess () returned 0xffffffff [0234.215] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e738 | out: TokenHandle=0x18e738*=0x45c) returned 1 [0234.217] GetCurrentProcess () returned 0xffffffff [0234.217] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e748 | out: TokenHandle=0x18e748*=0x460) returned 1 [0234.222] GetTimeZoneInformation (in: lpTimeZoneInformation=0x18e8b8 | out: lpTimeZoneInformation=0x18e8b8) returned 0x2 [0234.226] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x18e714 | out: pTimeZoneInformation=0x18e714) returned 0x2 [0234.229] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e7f8 | out: phkResult=0x18e7f8*=0x464) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x464, lpValueName="TZI", lpReserved=0x0, lpType=0x18e814, lpData=0x0, lpcbData=0x18e810*=0x0 | out: lpType=0x18e814*=0x3, lpData=0x0, lpcbData=0x18e810*=0x2c) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x464, lpValueName="TZI", lpReserved=0x0, lpType=0x18e814, lpData=0x22ef004, lpcbData=0x18e810*=0x2c | out: lpType=0x18e814*=0x3, lpData=0x22ef004*, lpcbData=0x18e810*=0x2c) returned 0x0 [0234.231] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e64c | out: phkResult=0x18e64c*=0x0) returned 0x2 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18e7ec, lpData=0x0, lpcbData=0x18e7e8*=0x0 | out: lpType=0x18e7ec*=0x1, lpData=0x0, lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x18e7ec, lpData=0x22ef428, lpcbData=0x18e7e8*=0x20 | out: lpType=0x18e7ec*=0x1, lpData="@tzres.dll,-320", lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18e7ec, lpData=0x0, lpcbData=0x18e7e8*=0x0 | out: lpType=0x18e7ec*=0x1, lpData=0x0, lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x18e7ec, lpData=0x22ef480, lpcbData=0x18e7e8*=0x20 | out: lpType=0x18e7ec*=0x1, lpData="@tzres.dll,-322", lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18e7ec, lpData=0x0, lpcbData=0x18e7e8*=0x0 | out: lpType=0x18e7ec*=0x1, lpData=0x0, lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x464, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x18e7ec, lpData=0x22ef4d8, lpcbData=0x18e7e8*=0x20 | out: lpType=0x18e7ec*=0x1, lpData="@tzres.dll,-321", lpcbData=0x18e7e8*=0x20) returned 0x0 [0234.324] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.324] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x7395a8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0234.334] CoTaskMemFree (pv=0x7395a8) [0234.335] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.335] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath=0x7395a8, pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800 | out: pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800) returned 1 [0234.345] CoTaskMemFree (pv=0x0) [0234.345] CoTaskMemFree (pv=0x7395a8) [0234.346] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5040001 [0234.352] CoTaskMemAlloc (cb=0x3ec) returned 0x7395a8 [0234.352] LoadStringW (in: hInstance=0x5040001, uID=0x140, lpBuffer=0x7395a8, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0234.352] CoTaskMemFree (pv=0x7395a8) [0234.352] FreeLibrary (hLibModule=0x5040001) returned 1 [0234.354] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.354] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x7395a8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0234.354] CoTaskMemFree (pv=0x7395a8) [0234.354] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.354] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath=0x7395a8, pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800 | out: pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800) returned 1 [0234.355] CoTaskMemFree (pv=0x0) [0234.355] CoTaskMemFree (pv=0x7395a8) [0234.355] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5040001 [0234.357] CoTaskMemAlloc (cb=0x3ec) returned 0x7395a8 [0234.357] LoadStringW (in: hInstance=0x5040001, uID=0x142, lpBuffer=0x7395a8, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0234.357] CoTaskMemFree (pv=0x7395a8) [0234.357] FreeLibrary (hLibModule=0x5040001) returned 1 [0234.358] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.358] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x7395a8 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0234.358] CoTaskMemFree (pv=0x7395a8) [0234.358] CoTaskMemAlloc (cb=0x20c) returned 0x7395a8 [0234.359] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath=0x7395a8, pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800 | out: pwszLanguage=0x0, pcchLanguage=0x18e808, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x18e80c, pululEnumerator=0x18e800) returned 1 [0234.361] CoTaskMemFree (pv=0x0) [0234.361] CoTaskMemFree (pv=0x7395a8) [0234.361] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5040001 [0234.362] CoTaskMemAlloc (cb=0x3ec) returned 0x7395a8 [0234.362] LoadStringW (in: hInstance=0x5040001, uID=0x141, lpBuffer=0x7395a8, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0234.363] CoTaskMemFree (pv=0x7395a8) [0234.364] FreeLibrary (hLibModule=0x5040001) returned 1 [0234.365] RegCloseKey (hKey=0x464) returned 0x0 [0234.365] SetEvent (hEvent=0x330) returned 1 [0234.392] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x18ea14 | out: pFixedInfo=0x0, pOutBufLen=0x18ea14) returned 0x6f [0234.516] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x7268f0 [0234.516] GetNetworkParams (in: pFixedInfo=0x7268f0, pOutBufLen=0x18ea14 | out: pFixedInfo=0x7268f0, pOutBufLen=0x18ea14) returned 0x0 [0234.537] LocalFree (hMem=0x7268f0) returned 0x0 [0234.539] CoTaskMemAlloc (cb=0x20c) returned 0x734858 [0234.540] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x734858, nSize=0x104 | out: lpBuffer="") returned 0x0 [0234.540] CoTaskMemFree (pv=0x734858) [0234.540] CoTaskMemAlloc (cb=0x20c) returned 0x734858 [0234.540] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x734858, nSize=0x104 | out: lpBuffer="") returned 0x0 [0234.540] CoTaskMemFree (pv=0x734858) [0234.548] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x50c [0234.553] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e4 [0234.555] GetAddrInfoW (in: pNodeName="t.me", pServiceName=0x0, pHints=0x18e8fc*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18e8a4 | out: ppResult=0x18e8a4*=0x71ea40*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="t.me", ai_addr=0x709eb8*(sa_family=2, sin_port=0x0, sin_addr="149.154.167.99"), ai_next=0x0)) returned 0 [0234.822] FreeAddrInfoW (pAddrInfo=0x71ea40*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="t.me", ai_addr=0x709eb8*(sa_family=2, sin_port=0x0, sin_addr="149.154.167.99"), ai_next=0x0)) [0234.826] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x514 [0234.826] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x51c [0234.826] ioctlsocket (in: s=0x514, cmd=-2147195266, argp=0x18e8d4 | out: argp=0x18e8d4) returned 0 [0234.826] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x520 [0234.827] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x524 [0234.827] ioctlsocket (in: s=0x520, cmd=-2147195266, argp=0x18e8d4 | out: argp=0x18e8d4) returned 0 [0234.827] WSAIoctl (in: s=0x514, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18e8bc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18e8bc, lpOverlapped=0x0) returned -1 [0234.827] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e5ec, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0234.827] WSAEventSelect (s=0x514, hEventObject=0x51c, lNetworkEvents=512) returned 0 [0234.827] WSAIoctl (in: s=0x520, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x18e8bc, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x18e8bc, lpOverlapped=0x0) returned -1 [0234.827] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x18e5ec, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0234.828] WSAEventSelect (s=0x520, hEventObject=0x524, lNetworkEvents=512) returned 0 [0234.828] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x18e8b8*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x18e8b8*=0xa34) returned 0x6f [0234.858] LocalAlloc (uFlags=0x0, uBytes=0xa34) returned 0x716b40 [0234.858] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x716b40, SizePointer=0x18e8b8*=0xa34 | out: AdapterAddresses=0x716b40*(Alignment=0x600000178, Length=0x178, IfIndex=0x6, Next=0x716df0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x716d64, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0x13, [2]=0x40, [3]=0xa7, [4]=0x5c, [5]=0x3d, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid.Value=0x6008002000000, Luid.Info.Reserved=0x6008002000000, Luid.Info.NetLuidIndex=0x6008002000000, Luid.Info.IfType=0x6008002000000, Dhcpv4Server.lpSockaddr=0x716cb8*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x18e8b8*=0xa34) returned 0x0 [0234.901] LocalFree (hMem=0x716b40) returned 0x0 [0234.908] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e8d4 | out: phkResult=0x18e8d4*=0x518) returned 0x0 [0234.908] RegQueryValueExW (in: hKey=0x518, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x18e8f0, lpData=0x0, lpcbData=0x18e8ec*=0x0 | out: lpType=0x18e8f0*=0x0, lpData=0x0, lpcbData=0x18e8ec*=0x0) returned 0x2 [0234.908] RegCloseKey (hKey=0x518) returned 0x0 [0234.912] WSAConnect (in: s=0x50c, name=0x22fb428*(sa_family=2, sin_port=0x1bb, sin_addr="149.154.167.99"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0234.930] closesocket (s=0x4e4) returned 0 [0234.966] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e820 | out: phkResult=0x18e820*=0x4e4) returned 0x0 [0234.966] RegQueryValueExW (in: hKey=0x4e4, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18e83c, lpData=0x0, lpcbData=0x18e838*=0x0 | out: lpType=0x18e83c*=0x4, lpData=0x0, lpcbData=0x18e838*=0x4) returned 0x0 [0234.967] RegQueryValueExW (in: hKey=0x4e4, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18e83c, lpData=0x18e828, lpcbData=0x18e838*=0x4 | out: lpType=0x18e83c*=0x4, lpData=0x18e828*=0x1, lpcbData=0x18e838*=0x4) returned 0x0 [0234.967] RegQueryValueExW (in: hKey=0x4e4, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x18e874, lpData=0x0, lpcbData=0x18e870*=0x0 | out: lpType=0x18e874*=0x4, lpData=0x0, lpcbData=0x18e870*=0x4) returned 0x0 [0234.970] RegCloseKey (hKey=0x4e4) returned 0x0 [0234.978] GetCurrentProcessId () returned 0xad0 [0234.982] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad0) returned 0x4e4 [0235.011] EnumProcessModules (in: hProcess=0x4e4, lphModule=0x22fd4b8, cb=0x100, lpcbNeeded=0x18e828 | out: lphModule=0x22fd4b8, lpcbNeeded=0x18e828) returned 1 [0235.015] GetModuleInformation (in: hProcess=0x4e4, hModule=0x3d0000, lpmodinfo=0x22fd5f8, cb=0xc | out: lpmodinfo=0x22fd5f8*(lpBaseOfDll=0x3d0000, SizeOfImage=0x22000, EntryPoint=0x0)) returned 1 [0235.016] CoTaskMemAlloc (cb=0x804) returned 0x716b40 [0235.016] GetModuleBaseNameW (in: hProcess=0x4e4, hModule=0x3d0000, lpBaseName=0x716b40, nSize=0x800 | out: lpBaseName="MSBuild.exe") returned 0xb [0235.017] CoTaskMemFree (pv=0x716b40) [0235.017] CoTaskMemAlloc (cb=0x804) returned 0x716b40 [0235.017] GetModuleFileNameExW (in: hProcess=0x4e4, hModule=0x3d0000, lpFilename=0x716b40, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe")) returned 0x39 [0235.018] CoTaskMemFree (pv=0x716b40) [0235.018] CloseHandle (hObject=0x4e4) returned 1 [0235.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0235.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0235.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e820 | out: phkResult=0x18e820*=0x0) returned 0x2 [0235.083] GetCurrentProcessId () returned 0xad0 [0235.083] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xad0) returned 0x4e4 [0235.083] EnumProcessModules (in: hProcess=0x4e4, lphModule=0x230296c, cb=0x100, lpcbNeeded=0x18e830 | out: lphModule=0x230296c, lpcbNeeded=0x18e830) returned 1 [0235.086] GetModuleInformation (in: hProcess=0x4e4, hModule=0x3d0000, lpmodinfo=0x2302aac, cb=0xc | out: lpmodinfo=0x2302aac*(lpBaseOfDll=0x3d0000, SizeOfImage=0x22000, EntryPoint=0x0)) returned 1 [0235.086] CoTaskMemAlloc (cb=0x804) returned 0x716b40 [0235.086] GetModuleBaseNameW (in: hProcess=0x4e4, hModule=0x3d0000, lpBaseName=0x716b40, nSize=0x800 | out: lpBaseName="MSBuild.exe") returned 0xb [0235.086] CoTaskMemFree (pv=0x716b40) [0235.087] CoTaskMemAlloc (cb=0x804) returned 0x716b40 [0235.087] GetModuleFileNameExW (in: hProcess=0x4e4, hModule=0x3d0000, lpFilename=0x716b40, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe")) returned 0x39 [0235.087] CoTaskMemFree (pv=0x716b40) [0235.087] CloseHandle (hObject=0x4e4) returned 1 [0235.087] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0235.088] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0235.088] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e828 | out: phkResult=0x18e828*=0x0) returned 0x2 [0235.088] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x18e828 | out: phkResult=0x18e828*=0x4e4) returned 0x0 [0235.088] RegQueryValueExW (in: hKey=0x4e4, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x18e844, lpData=0x0, lpcbData=0x18e840*=0x0 | out: lpType=0x18e844*=0x0, lpData=0x0, lpcbData=0x18e840*=0x0) returned 0x2 [0235.089] RegCloseKey (hKey=0x4e4) returned 0x0 [0235.133] EnumerateSecurityPackagesW (in: pcPackages=0x18e84c, ppPackageInfo=0x18e7e0 | out: pcPackages=0x18e84c, ppPackageInfo=0x18e7e0) returned 0x0 [0235.166] FreeContextBuffer (in: pvContextBuffer=0x73cd48 | out: pvContextBuffer=0x73cd48) returned 0x0 [0235.183] GetCurrentProcess () returned 0xffffffff [0235.183] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e62c | out: TokenHandle=0x18e62c*=0x52c) returned 1 [0235.187] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x2305080, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x18e680, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x2306588, ptsExpiry=0x18e604 | out: phCredential=0x2306588, ptsExpiry=0x18e604) returned 0x0 [0235.264] InitializeSecurityContextW (in: phCredential=0x18e644, phContext=0x0, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x2306724, pfContextAttr=0x2305054, ptsExpiry=0x18e63c | out: phNewContext=0x230678c, pOutput=0x2306724, pfContextAttr=0x2305054, ptsExpiry=0x18e63c) returned 0x90312 [0235.267] FreeContextBuffer (in: pvContextBuffer=0x70bb68 | out: pvContextBuffer=0x70bb68) returned 0x0 [0235.281] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76b60000 [0235.282] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x18e680, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatÃ\x8dm2÷n\x9c(ú5oÀî\x18", lpUsedDefaultChar=0x0) returned 21 [0235.282] GetProcAddress (hModule=0x76b60000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0235.283] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76b60000 [0235.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x18e680, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0235.283] GetProcAddress (hModule=0x76b60000, lpProcName="GetCurrentPackageId") returned 0x7725ded0 [0235.284] GetCurrentPackageId () returned 0x3d54 [0235.291] send (s=0x50c, buf=0x23067a0*, len=168, flags=0) returned 168 [0235.295] recv (in: s=0x50c, buf=0x23067a0, len=5, flags=0 | out: buf=0x23067a0*) returned 5 [0235.308] recv (in: s=0x50c, buf=0x23067a5, len=69, flags=0 | out: buf=0x23067a5*) returned 69 [0235.310] InitializeSecurityContextW (in: phCredential=0x18e5a8, phContext=0x18e634, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2306ba4, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x2306bb8, pfContextAttr=0x2305054, ptsExpiry=0x18e5a0 | out: phNewContext=0x230678c, pOutput=0x2306bb8, pfContextAttr=0x2305054, ptsExpiry=0x18e5a0) returned 0x90312 [0235.313] recv (in: s=0x50c, buf=0x2306c48, len=5, flags=0 | out: buf=0x2306c48*) returned 5 [0235.314] recv (in: s=0x50c, buf=0x2306c61, len=5095, flags=0 | out: buf=0x2306c61*) returned 5095 [0235.314] InitializeSecurityContextW (in: phCredential=0x18e510, phContext=0x18e59c, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23080b8, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x23080cc, pfContextAttr=0x2305054, ptsExpiry=0x18e508 | out: phNewContext=0x230678c, pOutput=0x23080cc, pfContextAttr=0x2305054, ptsExpiry=0x18e508) returned 0x90312 [0235.326] recv (in: s=0x50c, buf=0x230815c, len=5, flags=0 | out: buf=0x230815c*) returned 5 [0235.326] recv (in: s=0x50c, buf=0x2308175, len=333, flags=0 | out: buf=0x2308175*) returned 333 [0235.326] InitializeSecurityContextW (in: phCredential=0x18e478, phContext=0x18e504, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2308334, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x2308348, pfContextAttr=0x2305054, ptsExpiry=0x18e470 | out: phNewContext=0x230678c, pOutput=0x2308348, pfContextAttr=0x2305054, ptsExpiry=0x18e470) returned 0x90312 [0235.327] recv (in: s=0x50c, buf=0x23083d8, len=5, flags=0 | out: buf=0x23083d8*) returned 5 [0235.327] recv (in: s=0x50c, buf=0x23083f1, len=4, flags=0 | out: buf=0x23083f1*) returned 4 [0235.328] InitializeSecurityContextW (in: phCredential=0x18e3e0, phContext=0x18e46c, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2308468, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x230847c, pfContextAttr=0x2305054, ptsExpiry=0x18e3d8 | out: phNewContext=0x230678c, pOutput=0x230847c, pfContextAttr=0x2305054, ptsExpiry=0x18e3d8) returned 0x90312 [0236.231] FreeContextBuffer (in: pvContextBuffer=0x69dff8 | out: pvContextBuffer=0x69dff8) returned 0x0 [0236.231] send (s=0x50c, buf=0x23084f8*, len=126, flags=0) returned 126 [0236.233] recv (in: s=0x50c, buf=0x23084f8, len=5, flags=0 | out: buf=0x23084f8*) returned 5 [0236.246] recv (in: s=0x50c, buf=0x230859d, len=202, flags=0 | out: buf=0x230859d*) returned 202 [0236.247] InitializeSecurityContextW (in: phCredential=0x18e348, phContext=0x18e3d4, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x23086d8, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x23086ec, pfContextAttr=0x2305054, ptsExpiry=0x18e340 | out: phNewContext=0x230678c, pOutput=0x23086ec, pfContextAttr=0x2305054, ptsExpiry=0x18e340) returned 0x90312 [0236.248] recv (in: s=0x50c, buf=0x230877c, len=5, flags=0 | out: buf=0x230877c*) returned 5 [0236.249] recv (in: s=0x50c, buf=0x2308795, len=1, flags=0 | out: buf=0x2308795*) returned 1 [0236.249] InitializeSecurityContextW (in: phCredential=0x18e2b0, phContext=0x18e33c, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2308808, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x230881c, pfContextAttr=0x2305054, ptsExpiry=0x18e2a8 | out: phNewContext=0x230678c, pOutput=0x230881c, pfContextAttr=0x2305054, ptsExpiry=0x18e2a8) returned 0x90312 [0236.250] recv (in: s=0x50c, buf=0x23088ac, len=5, flags=0 | out: buf=0x23088ac*) returned 5 [0236.250] recv (in: s=0x50c, buf=0x23088c5, len=40, flags=0 | out: buf=0x23088c5*) returned 40 [0236.250] InitializeSecurityContextW (in: phCredential=0x18e218, phContext=0x18e2a4, pTargetName=0x22fb508, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x2308960, Reserved2=0x0, phNewContext=0x230678c, pOutput=0x2308974, pfContextAttr=0x2305054, ptsExpiry=0x18e210 | out: phNewContext=0x230678c, pOutput=0x2308974, pfContextAttr=0x2305054, ptsExpiry=0x18e210) returned 0x0 [0236.337] QueryContextAttributesW (in: phContext=0x230678c, ulAttribute=0x4, pBuffer=0x2308a20 | out: pBuffer=0x2308a20) returned 0x0 [0236.338] QueryContextAttributesW (in: phContext=0x230678c, ulAttribute=0x5a, pBuffer=0x2308a78 | out: pBuffer=0x2308a78) returned 0x0 [0236.359] QueryContextAttributesW (in: phContext=0x230678c, ulAttribute=0x53, pBuffer=0x2308d2c | out: pBuffer=0x2308d2c) returned 0x0 [0236.378] CertDuplicateCertificateContext (pCertContext=0x6fcf40) returned 0x6fcf40 [0236.380] CertDuplicateStore (hCertStore=0x6b0038) returned 0x6b0038 [0236.381] CertEnumCertificatesInStore (hCertStore=0x6b0038, pPrevCertContext=0x0) returned 0x6fd120 [0236.382] CertDuplicateCertificateContext (pCertContext=0x6fd120) returned 0x6fd120 [0236.383] CertEnumCertificatesInStore (hCertStore=0x6b0038, pPrevCertContext=0x6fd120) returned 0x6fd080 [0236.383] CertDuplicateCertificateContext (pCertContext=0x6fd080) returned 0x6fd080 [0236.383] CertEnumCertificatesInStore (hCertStore=0x6b0038, pPrevCertContext=0x6fd080) returned 0x6fd0d0 [0236.383] CertDuplicateCertificateContext (pCertContext=0x6fd0d0) returned 0x6fd0d0 [0236.383] CertEnumCertificatesInStore (hCertStore=0x6b0038, pPrevCertContext=0x6fd0d0) returned 0x6fcf40 [0236.384] CertDuplicateCertificateContext (pCertContext=0x6fcf40) returned 0x6fcf40 [0236.384] CertEnumCertificatesInStore (hCertStore=0x6b0038, pPrevCertContext=0x6fcf40) returned 0x0 [0236.384] CertCloseStore (hCertStore=0x6b0038, dwFlags=0x0) returned 1 [0236.384] CertFreeCertificateContext (pCertContext=0x6fcf40) returned 1 [0236.420] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x6b0128 [0236.424] CertAddCRLLinkToStore (in: hCertStore=0x6b0128, pCrlContext=0x6fd120, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.427] CertAddCRLLinkToStore (in: hCertStore=0x6b0128, pCrlContext=0x6fd080, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.427] CertAddCRLLinkToStore (in: hCertStore=0x6b0128, pCrlContext=0x6fd0d0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.427] CertAddCRLLinkToStore (in: hCertStore=0x6b0128, pCrlContext=0x6fcf40, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0236.436] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x6fcf40, pTime=0x18e224, hAdditionalStore=0x6b0128, pChainPara=0x18e164, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x18e158 | out: ppChainContext=0x18e158) returned 1 [0236.463] CertDuplicateCertificateChain (pChainContext=0x72cb40) returned 0x72cb40 [0236.464] CertDuplicateCertificateContext (pCertContext=0x6fcf40) returned 0x6fcf40 [0236.464] CertDuplicateCertificateContext (pCertContext=0x72b1b8) returned 0x72b1b8 [0236.465] CertDuplicateCertificateContext (pCertContext=0x72ba78) returned 0x72ba78 [0236.465] CertDuplicateCertificateContext (pCertContext=0x72b528) returned 0x72b528 [0236.465] CertFreeCertificateChain (pChainContext=0x72cb40) [0236.466] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x72cb40, pPolicyPara=0x18e304, pPolicyStatus=0x18e2f0 | out: pPolicyStatus=0x18e2f0) returned 1 [0236.468] SetLastError (dwErrCode=0x0) [0236.509] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x72cb40, pPolicyPara=0x18e370, pPolicyStatus=0x18e318 | out: pPolicyStatus=0x18e318) returned 1 [0236.518] CertFreeCertificateChain (pChainContext=0x72cb40) [0236.518] CertFreeCertificateContext (pCertContext=0x6fcf40) returned 1 [0236.530] CoTaskMemAlloc (cb=0x20c) returned 0x72cb40 [0236.530] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x72cb40, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.530] CoTaskMemFree (pv=0x72cb40) [0236.530] CoTaskMemAlloc (cb=0x20c) returned 0x72cb40 [0236.530] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x72cb40, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.531] CoTaskMemFree (pv=0x72cb40) [0236.531] CoTaskMemAlloc (cb=0x20c) returned 0x72cb40 [0236.531] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x72cb40, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.531] CoTaskMemFree (pv=0x72cb40) [0236.531] CoTaskMemAlloc (cb=0x20c) returned 0x72cb40 [0236.531] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x72cb40, nSize=0x104 | out: lpBuffer="") returned 0x0 [0236.531] CoTaskMemFree (pv=0x72cb40) [0236.537] EncryptMessage (in: phContext=0x230678c, fQOP=0x0, pMessage=0x231141c, MessageSeqNo=0x0 | out: pMessage=0x231141c) returned 0x0 [0236.538] send (s=0x50c, buf=0x230fef4*, len=100, flags=0) returned 100 [0236.540] setsockopt (s=0x50c, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0236.546] recv (in: s=0x50c, buf=0x231d72c, len=5, flags=0 | out: buf=0x231d72c*) returned 5 [0236.569] recv (in: s=0x50c, buf=0x231d731, len=12830, flags=0 | out: buf=0x231d731*) returned 12395 [0236.569] recv (in: s=0x50c, buf=0x232079c, len=435, flags=0 | out: buf=0x232079c*) returned 435 [0236.583] DecryptMessage (in: phContext=0x230678c, pMessage=0x23217ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x23217ec, pfQOP=0x0) returned 0x0 [0236.623] setsockopt (s=0x50c, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0236.623] SetEvent (hEvent=0x330) returned 1 [0241.976] GetCurrentProcess () returned 0xffffffff [0241.976] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e1c4 | out: TokenHandle=0x18e1c4*=0x60c) returned 1 [0242.116] GetCurrentProcess () returned 0xffffffff [0242.116] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e1d4 | out: TokenHandle=0x18e1d4*=0x614) returned 1 [0252.837] GetCurrentProcess () returned 0xffffffff [0252.837] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e8e4 | out: TokenHandle=0x18e8e4*=0x618) returned 1 [0252.933] GetCurrentProcess () returned 0xffffffff [0252.934] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e8f4 | out: TokenHandle=0x18e8f4*=0x61c) returned 1 [0257.963] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76b60000 [0258.062] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="AppPolicyGetClrCompat", cchWideChar=21, lpMultiByteStr=0x18e9f0, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppPolicyGetClrCompatî\x18", lpUsedDefaultChar=0x0) returned 21 [0258.063] GetProcAddress (hModule=0x76b60000, lpProcName="AppPolicyGetClrCompat") returned 0x0 [0258.063] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76b60000 [0258.063] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x18e9f0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId", lpUsedDefaultChar=0x0) returned 19 [0258.063] GetProcAddress (hModule=0x76b60000, lpProcName="GetCurrentPackageId") returned 0x7725ded0 [0258.146] GetCurrentPackageId () returned 0x3d54 [0274.309] EtwEventRegister (in: ProviderId=0x237d5a8, EnableCallback=0x46e0676, CallbackContext=0x0, RegHandle=0x237d584 | out: RegHandle=0x237d584) returned 0x0 [0280.585] CoCreateGuid (in: pguid=0x18e9a4 | out: pguid=0x18e9a4*(Data1=0x3a411259, Data2=0x89ee, Data3=0x468c, Data4=([0]=0x81, [1]=0x5e, [2]=0xc3, [3]=0x37, [4]=0xc5, [5]=0x8c, [6]=0xa0, [7]=0xad))) returned 0x0 [0281.864] CoCreateGuid (in: pguid=0x18e8e4 | out: pguid=0x18e8e4*(Data1=0x3f1a3417, Data2=0x1273, Data3=0x4072, Data4=([0]=0xab, [1]=0xfa, [2]=0x80, [3]=0xee, [4]=0xd9, [5]=0x71, [6]=0xc9, [7]=0xd2))) returned 0x0 [0283.532] CoCreateGuid (in: pguid=0x18e74c | out: pguid=0x18e74c*(Data1=0xb9ad1462, Data2=0x8297, Data3=0x430e, Data4=([0]=0xb3, [1]=0x9, [2]=0x50, [3]=0xc7, [4]=0x35, [5]=0x14, [6]=0x9c, [7]=0x6))) returned 0x0 [0285.813] GetAddrInfoW (in: pNodeName="spahere.top", pServiceName=0x0, pHints=0x18e5c8*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x18e570 | out: ppResult=0x18e570*=0x5854fe0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="spahere.top", ai_addr=0x70a6e0*(sa_family=2, sin_port=0x0, sin_addr="65.21.63.6"), ai_next=0x0)) returned 0 [0285.922] FreeAddrInfoW (pAddrInfo=0x5854fe0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="spahere.top", ai_addr=0x70a6e0*(sa_family=2, sin_port=0x0, sin_addr="65.21.63.6"), ai_next=0x0)) [0285.929] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x620 [0285.931] WSAConnect (in: s=0x620, name=0x2382858*(sa_family=2, sin_port=0x1bb, sin_addr="65.21.63.6"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0286.103] setsockopt (s=0x620, level=65535, optname=4098, optval="", optlen=4) returned 0 [0286.104] setsockopt (s=0x620, level=65535, optname=4097, optval="", optlen=4) returned 0 [0286.746] setsockopt (s=0x620, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0286.854] setsockopt (s=0x620, level=65535, optname=4101, optval="\x1cl\x1b", optlen=4) returned 0 [0286.854] send (s=0x620, buf=0x2380780*, len=36, flags=0) returned 36 [0287.022] setsockopt (s=0x620, level=65535, optname=4102, optval="Gj\x1b", optlen=4) returned 0 [0287.022] recv (in: s=0x620, buf=0x23a2be8, len=1, flags=0 | out: buf=0x23a2be8*) returned 1 [0290.126] send (s=0x620, buf=0x23a350b*, len=159, flags=0) returned 159 [0290.445] recv (in: s=0x620, buf=0x23a4420, len=8192, flags=0 | out: buf=0x23a4420*) returned 159 [0295.799] CoCreateGuid (in: pguid=0x18e984 | out: pguid=0x18e984*(Data1=0xe1ca3c82, Data2=0x7921, Data3=0x4bd0, Data4=([0]=0xbb, [1]=0xd9, [2]=0x31, [3]=0x9c, [4]=0xe, [5]=0x28, [6]=0x48, [7]=0x43))) returned 0x0 [0296.170] CoCreateGuid (in: pguid=0x18e8c4 | out: pguid=0x18e8c4*(Data1=0x756cd734, Data2=0x5a84, Data3=0x40a5, Data4=([0]=0x90, [1]=0x2e, [2]=0xe6, [3]=0x7d, [4]=0x1e, [5]=0xa6, [6]=0xdb, [7]=0xfb))) returned 0x0 [0296.345] send (s=0x620, buf=0x23a350c*, len=111, flags=0) returned 111 [0296.353] recv (in: s=0x620, buf=0x23a4420, len=8192, flags=0 | out: buf=0x23a4420*) returned 7068 [0297.381] GetCurrentProcess () returned 0xffffffff [0297.381] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e198 | out: TokenHandle=0x18e198*=0x628) returned 1 [0297.387] GetCurrentProcess () returned 0xffffffff [0297.387] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e1a8 | out: TokenHandle=0x18e1a8*=0x630) returned 1 [0303.941] GetCurrentProcess () returned 0xffffffff [0303.941] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e7c0 | out: TokenHandle=0x18e7c0*=0x634) returned 1 [0303.984] GetCurrentProcess () returned 0xffffffff [0303.984] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e7d0 | out: TokenHandle=0x18e7d0*=0x638) returned 1 [0304.019] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0304.020] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0304.029] GetModuleHandleW (lpModuleName="webengine4.dll") returned 0x0 [0304.044] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\webengine4.dll") returned 0x6b3d0000 [0304.238] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0304.240] CoUninitialize () [0304.296] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x18e298 | out: UnbiasedTime=0x18e298) returned 1 [0304.322] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x18e288 | out: UnbiasedTime=0x18e288) returned 1 [0304.323] GetCurrentProcess () returned 0xffffffff [0304.324] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e2bc | out: TokenHandle=0x18e2bc*=0x660) returned 1 [0304.324] GetCurrentProcess () returned 0xffffffff [0304.324] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x18e290 | out: TokenHandle=0x18e290*=0x67c) returned 1 [0304.325] GetTokenInformation (in: TokenHandle=0x660, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x18e2c4 | out: TokenInformation=0x0, ReturnLength=0x18e2c4) returned 0 [0304.326] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x586eb60 [0304.326] GetTokenInformation (in: TokenHandle=0x660, TokenInformationClass=0x1, TokenInformation=0x586eb60, TokenInformationLength=0x24, ReturnLength=0x18e2c4 | out: TokenInformation=0x586eb60, ReturnLength=0x18e2c4) returned 1 [0304.331] LocalFree (hMem=0x586eb60) returned 0x0 [0304.334] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x18e1e0, DesiredAccess=0x800, PolicyHandle=0x18e1a0 | out: PolicyHandle=0x18e1a0) returned 0x0 [0304.341] LsaLookupSids (in: PolicyHandle=0x72d288, Count=0x1, Sids=0x23f2c60*=0x23f2bcc*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), ReferencedDomains=0x18e1bc, Names=0x18e1b0 | out: ReferencedDomains=0x18e1bc, Names=0x18e1b0) returned 0x0 [0304.349] LsaClose (ObjectHandle=0x72d288) returned 0x0 [0304.350] LsaFreeMemory (Buffer=0x733e30) returned 0x0 [0304.350] LsaFreeMemory (Buffer=0x587ad28) returned 0x0 [0305.017] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec1c | out: puCount=0x18ec1c*=0x2) returned 0x0 [0305.018] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0x0, pszText=0x0 | out: puBuffLength=0x18ec18*=0xf, pszText=0x0) returned 0x0 [0305.019] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec18*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec18*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0305.025] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eba4 | out: ppv=0x18eba4*=0x692bc4) returned 0x0 [0305.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb9c | out: pAptType=0x18eb9c*=1) returned 0x0 [0305.026] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eba0 | out: ppvObject=0x18eba0*=0x0) returned 0x80004002 [0305.026] IUnknown:Release (This=0x692bc4) returned 0x1 [0305.029] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e7b0 | out: ppv=0x18e7b0*=0x5896e70) returned 0x0 [0305.031] WbemLocator:IUnknown:QueryInterface (in: This=0x5896e70, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9cc | out: ppvObject=0x18e9cc*=0x0) returned 0x80004002 [0305.031] WbemLocator:IClassFactory:CreateInstance (in: This=0x5896e70, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9d8 | out: ppvObject=0x18e9d8*=0x586b660) returned 0x0 [0305.031] WbemLocator:IUnknown:Release (This=0x5896e70) returned 0x0 [0305.031] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5fc | out: ppvObject=0x18e5fc*=0x586b660) returned 0x0 [0305.032] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5b8 | out: ppvObject=0x18e5b8*=0x0) returned 0x80004002 [0305.032] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ac | out: ppvObject=0x18e1ac*=0x0) returned 0x80004002 [0305.032] WbemLocator:IUnknown:AddRef (This=0x586b660) returned 0x3 [0305.032] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df0c | out: ppvObject=0x18df0c*=0x0) returned 0x80004002 [0305.032] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18debc | out: ppvObject=0x18debc*=0x0) returned 0x80004002 [0305.032] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dec8 | out: ppvObject=0x18dec8*=0x0) returned 0x80004002 [0305.032] CoGetContextToken (in: pToken=0x18df28 | out: pToken=0x18df28) returned 0x0 [0305.033] CoGetContextToken (in: pToken=0x18e330 | out: pToken=0x18e330) returned 0x0 [0305.033] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3bc | out: ppvObject=0x18e3bc*=0x0) returned 0x80004002 [0305.033] WbemLocator:IUnknown:Release (This=0x586b660) returned 0x2 [0305.033] WbemLocator:IUnknown:Release (This=0x586b660) returned 0x1 [0305.033] CoGetContextToken (in: pToken=0x18e9b8 | out: pToken=0x18e9b8) returned 0x0 [0305.033] CoGetContextToken (in: pToken=0x18e918 | out: pToken=0x18e918) returned 0x0 [0305.033] WbemLocator:IUnknown:QueryInterface (in: This=0x586b660, riid=0x18e9e8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9e4 | out: ppvObject=0x18e9e4*=0x586b660) returned 0x0 [0305.034] WbemLocator:IUnknown:AddRef (This=0x586b660) returned 0x3 [0305.034] WbemLocator:IUnknown:Release (This=0x586b660) returned 0x2 [0305.034] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb80 | out: puCount=0x18eb80*=0x2) returned 0x0 [0305.034] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb7c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb7c*=0xf, pszText=0x0) returned 0x0 [0305.035] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0305.038] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea58 | out: ppv=0x18ea58*=0x586b650) returned 0x0 [0305.039] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b650, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaec | out: ppNamespace=0x18eaec*=0x72bd08) returned 0x0 [0305.140] WbemLocator:IUnknown:QueryInterface (in: This=0x72bd08, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e980 | out: ppvObject=0x18e980*=0x6c2be4) returned 0x0 [0305.140] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2be4, pProxy=0x72bd08, pAuthnSvc=0x18e9d0, pAuthzSvc=0x18e9cc, pServerPrincName=0x18e9c4, pAuthnLevel=0x18e9c8, pImpLevel=0x18e9b8, pAuthInfo=0x18e9bc, pCapabilites=0x18e9c0 | out: pAuthnSvc=0x18e9d0*=0xa, pAuthzSvc=0x18e9cc*=0x0, pServerPrincName=0x18e9c4, pAuthnLevel=0x18e9c8*=0x6, pImpLevel=0x18e9b8*=0x2, pAuthInfo=0x18e9bc, pCapabilites=0x18e9c0*=0x1) returned 0x0 [0305.140] WbemLocator:IUnknown:Release (This=0x6c2be4) returned 0x1 [0305.140] WbemLocator:IUnknown:QueryInterface (in: This=0x72bd08, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x6c2c08) returned 0x0 [0305.140] WbemLocator:IUnknown:QueryInterface (in: This=0x72bd08, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e960 | out: ppvObject=0x18e960*=0x6c2be4) returned 0x0 [0305.140] WbemLocator:IClientSecurity:SetBlanket (This=0x6c2be4, pProxy=0x72bd08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0305.141] WbemLocator:IUnknown:Release (This=0x6c2be4) returned 0x2 [0305.141] WbemLocator:IUnknown:Release (This=0x6c2c08) returned 0x1 [0305.141] CoTaskMemFree (pv=0x586e8c0) [0305.141] WbemLocator:IUnknown:Release (This=0x586b650) returned 0x0 [0305.142] WbemLocator:IUnknown:QueryInterface (in: This=0x72bd08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e570 | out: ppvObject=0x18e570*=0x6c2c08) returned 0x0 [0305.142] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e52c | out: ppvObject=0x18e52c*=0x0) returned 0x80004002 [0305.143] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0x0) returned 0x80004002 [0305.144] WbemLocator:IUnknown:QueryInterface (in: This=0x72bd08, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e124 | out: ppvObject=0x18e124*=0x0) returned 0x80004002 [0305.145] WbemLocator:IUnknown:AddRef (This=0x6c2c08) returned 0x3 [0305.145] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de84 | out: ppvObject=0x18de84*=0x0) returned 0x80004002 [0305.145] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de34 | out: ppvObject=0x18de34*=0x0) returned 0x80004002 [0305.145] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de40 | out: ppvObject=0x18de40*=0x6c2b64) returned 0x0 [0305.145] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2b64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de48 | out: pCid=0x18de48*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0305.145] WbemLocator:IUnknown:Release (This=0x6c2b64) returned 0x3 [0305.145] CoGetContextToken (in: pToken=0x18dea0 | out: pToken=0x18dea0) returned 0x0 [0305.146] CoGetContextToken (in: pToken=0x18e2a8 | out: pToken=0x18e2a8) returned 0x0 [0305.146] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e334 | out: ppvObject=0x18e334*=0x6c2bec) returned 0x0 [0305.146] WbemLocator:IRpcOptions:Query (in: This=0x6c2bec, pPrx=0x6c2c08, dwProperty=2, pdwValue=0x18e340 | out: pdwValue=0x18e340) returned 0x80004002 [0305.146] WbemLocator:IUnknown:Release (This=0x6c2bec) returned 0x3 [0305.146] WbemLocator:IUnknown:Release (This=0x6c2c08) returned 0x2 [0305.146] CoGetContextToken (in: pToken=0x18e880 | out: pToken=0x18e880) returned 0x0 [0305.146] CoGetContextToken (in: pToken=0x18e7e0 | out: pToken=0x18e7e0) returned 0x0 [0305.146] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x18e8b0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e8ac | out: ppvObject=0x18e8ac*=0x72bd08) returned 0x0 [0305.146] WbemLocator:IUnknown:AddRef (This=0x72bd08) returned 0x4 [0305.146] WbemLocator:IUnknown:Release (This=0x72bd08) returned 0x3 [0305.146] WbemLocator:IUnknown:Release (This=0x72bd08) returned 0x2 [0305.147] SysStringLen (param_1=0x0) returned 0x0 [0305.147] CoGetContextToken (in: pToken=0x18e888 | out: pToken=0x18e888) returned 0x0 [0305.147] WbemLocator:IUnknown:AddRef (This=0x6c2c08) returned 0x3 [0305.147] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2c08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e71c | out: ppvObject=0x18e71c*=0x6c2c08) returned 0x0 [0305.147] WbemLocator:IUnknown:Release (This=0x6c2c08) returned 0x3 [0305.147] WbemLocator:IUnknown:Release (This=0x6c2c08) returned 0x2 [0305.147] CoGetContextToken (in: pToken=0x18e970 | out: pToken=0x18e970) returned 0x0 [0305.147] WbemLocator:IUnknown:AddRef (This=0x72bd08) returned 0x3 [0305.147] IWbemServices:ExecQuery (in: This=0x72bd08, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x18eb8c | out: ppEnum=0x18eb8c*=0x73c5e0) returned 0x0 [0305.201] IUnknown:QueryInterface (in: This=0x73c5e0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9dc | out: ppvObject=0x18e9dc*=0x73c5e4) returned 0x0 [0305.202] IClientSecurity:QueryBlanket (in: This=0x73c5e4, pProxy=0x73c5e0, pAuthnSvc=0x18ea2c, pAuthzSvc=0x18ea28, pServerPrincName=0x18ea20, pAuthnLevel=0x18ea24, pImpLevel=0x18ea14, pAuthInfo=0x18ea18, pCapabilites=0x18ea1c | out: pAuthnSvc=0x18ea2c*=0xa, pAuthzSvc=0x18ea28*=0x0, pServerPrincName=0x18ea20, pAuthnLevel=0x18ea24*=0x6, pImpLevel=0x18ea14*=0x2, pAuthInfo=0x18ea18, pCapabilites=0x18ea1c*=0x1) returned 0x0 [0305.202] IUnknown:Release (This=0x73c5e4) returned 0x1 [0305.202] IUnknown:QueryInterface (in: This=0x73c5e0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9d0 | out: ppvObject=0x18e9d0*=0x6c1908) returned 0x0 [0305.202] IUnknown:QueryInterface (in: This=0x73c5e0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x73c5e4) returned 0x0 [0305.202] IClientSecurity:SetBlanket (This=0x73c5e4, pProxy=0x73c5e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0305.207] IUnknown:Release (This=0x73c5e4) returned 0x2 [0305.207] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x1 [0305.207] CoTaskMemFree (pv=0x586e710) [0305.208] IUnknown:QueryInterface (in: This=0x73c5e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5c8 | out: ppvObject=0x18e5c8*=0x6c1908) returned 0x0 [0305.208] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e584 | out: ppvObject=0x18e584*=0x0) returned 0x80004002 [0305.209] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e3a4 | out: ppvObject=0x18e3a4*=0x0) returned 0x80004002 [0305.210] IUnknown:QueryInterface (in: This=0x73c5e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e17c | out: ppvObject=0x18e17c*=0x0) returned 0x80004002 [0305.211] WbemLocator:IUnknown:AddRef (This=0x6c1908) returned 0x3 [0305.211] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dedc | out: ppvObject=0x18dedc*=0x0) returned 0x80004002 [0305.211] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de8c | out: ppvObject=0x18de8c*=0x0) returned 0x80004002 [0305.211] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de98 | out: ppvObject=0x18de98*=0x6c1864) returned 0x0 [0305.212] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dea0 | out: pCid=0x18dea0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0305.212] WbemLocator:IUnknown:Release (This=0x6c1864) returned 0x3 [0305.212] CoGetContextToken (in: pToken=0x18def8 | out: pToken=0x18def8) returned 0x0 [0305.212] CoGetContextToken (in: pToken=0x18e300 | out: pToken=0x18e300) returned 0x0 [0305.212] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e38c | out: ppvObject=0x18e38c*=0x6c18ec) returned 0x0 [0305.212] WbemLocator:IRpcOptions:Query (in: This=0x6c18ec, pPrx=0x6c1908, dwProperty=2, pdwValue=0x18e398 | out: pdwValue=0x18e398) returned 0x80004002 [0305.212] WbemLocator:IUnknown:Release (This=0x6c18ec) returned 0x3 [0305.213] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x2 [0305.213] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0305.213] CoGetContextToken (in: pToken=0x18e838 | out: pToken=0x18e838) returned 0x0 [0305.213] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x18e908*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e904 | out: ppvObject=0x18e904*=0x73c5e0) returned 0x0 [0305.213] IUnknown:AddRef (This=0x73c5e0) returned 0x4 [0305.213] IUnknown:Release (This=0x73c5e0) returned 0x3 [0305.213] IUnknown:Release (This=0x73c5e0) returned 0x2 [0305.213] WbemLocator:IUnknown:Release (This=0x72bd08) returned 0x2 [0305.213] SysStringLen (param_1=0x0) returned 0x0 [0305.213] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebd8 | out: puCount=0x18ebd8*=0x2) returned 0x0 [0305.213] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebd4*=0xf, pszText=0x0) returned 0x0 [0305.213] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebd4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0305.213] CoGetContextToken (in: pToken=0x18ea28 | out: pToken=0x18ea28) returned 0x0 [0305.213] IUnknown:AddRef (This=0x73c5e0) returned 0x3 [0305.214] IEnumWbemClassObject:Clone (in: This=0x73c5e0, ppEnum=0x18ebe4 | out: ppEnum=0x18ebe4*=0x73c450) returned 0x0 [0305.216] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eaa0 | out: ppvObject=0x18eaa0*=0x73c454) returned 0x0 [0305.216] IClientSecurity:QueryBlanket (in: This=0x73c454, pProxy=0x73c450, pAuthnSvc=0x18eaf0, pAuthzSvc=0x18eaec, pServerPrincName=0x18eae4, pAuthnLevel=0x18eae8, pImpLevel=0x18ead8, pAuthInfo=0x18eadc, pCapabilites=0x18eae0 | out: pAuthnSvc=0x18eaf0*=0xa, pAuthzSvc=0x18eaec*=0x0, pServerPrincName=0x18eae4, pAuthnLevel=0x18eae8*=0x6, pImpLevel=0x18ead8*=0x2, pAuthInfo=0x18eadc, pCapabilites=0x18eae0*=0x1) returned 0x0 [0305.216] IUnknown:Release (This=0x73c454) returned 0x1 [0305.216] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea94 | out: ppvObject=0x18ea94*=0x6c1808) returned 0x0 [0305.217] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea80 | out: ppvObject=0x18ea80*=0x73c454) returned 0x0 [0305.217] IClientSecurity:SetBlanket (This=0x73c454, pProxy=0x73c450, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0305.254] IUnknown:Release (This=0x73c454) returned 0x2 [0305.255] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0305.255] CoTaskMemFree (pv=0x586e980) [0305.255] IUnknown:QueryInterface (in: This=0x73c450, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e67c | out: ppvObject=0x18e67c*=0x6c1808) returned 0x0 [0305.256] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x0) returned 0x80004002 [0305.257] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e454 | out: ppvObject=0x18e454*=0x0) returned 0x80004002 [0305.257] IUnknown:QueryInterface (in: This=0x73c450, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e22c | out: ppvObject=0x18e22c*=0x0) returned 0x80004002 [0305.258] WbemLocator:IUnknown:AddRef (This=0x6c1808) returned 0x3 [0305.258] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df8c | out: ppvObject=0x18df8c*=0x0) returned 0x80004002 [0305.258] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df3c | out: ppvObject=0x18df3c*=0x0) returned 0x80004002 [0305.259] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df48 | out: ppvObject=0x18df48*=0x6c1764) returned 0x0 [0305.259] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1764, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df50 | out: pCid=0x18df50*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0305.259] WbemLocator:IUnknown:Release (This=0x6c1764) returned 0x3 [0305.259] CoGetContextToken (in: pToken=0x18dfa8 | out: pToken=0x18dfa8) returned 0x0 [0305.259] CoGetContextToken (in: pToken=0x18e3b0 | out: pToken=0x18e3b0) returned 0x0 [0305.259] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e43c | out: ppvObject=0x18e43c*=0x6c17ec) returned 0x0 [0305.259] WbemLocator:IRpcOptions:Query (in: This=0x6c17ec, pPrx=0x6c1808, dwProperty=2, pdwValue=0x18e448 | out: pdwValue=0x18e448) returned 0x80004002 [0305.260] WbemLocator:IUnknown:Release (This=0x6c17ec) returned 0x3 [0305.260] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x2 [0305.260] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0305.260] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0305.260] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x18e9c0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x73c450) returned 0x0 [0305.260] IUnknown:AddRef (This=0x73c450) returned 0x4 [0305.260] IUnknown:Release (This=0x73c450) returned 0x3 [0305.260] IUnknown:Release (This=0x73c450) returned 0x2 [0305.260] IUnknown:Release (This=0x73c5e0) returned 0x2 [0305.260] SysStringLen (param_1=0x0) returned 0x0 [0305.260] IEnumWbemClassObject:Reset (This=0x73c450) returned 0x0 [0305.262] CoTaskMemAlloc (cb=0x4) returned 0x586b570 [0305.262] IEnumWbemClassObject:Next (in: This=0x73c450, lTimeout=-1, uCount=0x1, apObjects=0x586b570, puReturned=0x240c684 | out: apObjects=0x586b570*=0x6f2bf8, puReturned=0x240c684*=0x1) returned 0x0 [0305.691] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e240 | out: ppvObject=0x18e240*=0x6f2bf8) returned 0x0 [0305.692] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0305.692] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e01c | out: ppvObject=0x18e01c*=0x0) returned 0x80004002 [0305.692] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddf4 | out: ppvObject=0x18ddf4*=0x0) returned 0x80004002 [0305.693] IUnknown:AddRef (This=0x6f2bf8) returned 0x3 [0305.693] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db54 | out: ppvObject=0x18db54*=0x0) returned 0x80004002 [0305.693] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db04 | out: ppvObject=0x18db04*=0x0) returned 0x80004002 [0305.693] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db10 | out: ppvObject=0x18db10*=0x6f2bfc) returned 0x0 [0305.693] IMarshal:GetUnmarshalClass (in: This=0x6f2bfc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db18 | out: pCid=0x18db18*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0305.693] IUnknown:Release (This=0x6f2bfc) returned 0x3 [0305.693] CoGetContextToken (in: pToken=0x18db70 | out: pToken=0x18db70) returned 0x0 [0305.694] CoGetContextToken (in: pToken=0x18df78 | out: pToken=0x18df78) returned 0x0 [0305.694] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e004 | out: ppvObject=0x18e004*=0x0) returned 0x80004002 [0305.694] IUnknown:Release (This=0x6f2bf8) returned 0x2 [0305.694] CoGetContextToken (in: pToken=0x18e550 | out: pToken=0x18e550) returned 0x0 [0305.694] CoGetContextToken (in: pToken=0x18e4b0 | out: pToken=0x18e4b0) returned 0x0 [0305.694] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x18e580*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e57c | out: ppvObject=0x18e57c*=0x6f2bf8) returned 0x0 [0305.694] IUnknown:AddRef (This=0x6f2bf8) returned 0x4 [0305.694] IUnknown:Release (This=0x6f2bf8) returned 0x3 [0305.694] IUnknown:Release (This=0x6f2bf8) returned 0x2 [0305.694] CoTaskMemFree (pv=0x586b570) [0305.694] CoGetContextToken (in: pToken=0x18e8c0 | out: pToken=0x18e8c0) returned 0x0 [0305.694] IUnknown:AddRef (This=0x6f2bf8) returned 0x3 [0305.695] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="__GENUS", lFlags=0, pVal=0x18ebd4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec54*=0, plFlavor=0x18ec50*=0 | out: pVal=0x18ebd4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec54*=3, plFlavor=0x18ec50*=64) returned 0x0 [0305.695] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="__PATH", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec3c*=0, plFlavor=0x18ec38*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x18ec3c*=8, plFlavor=0x18ec38*=64) returned 0x0 [0305.696] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0305.696] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0305.696] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebe4 | out: ppv=0x18ebe4*=0x692bc4) returned 0x0 [0305.696] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebdc | out: pAptType=0x18ebdc*=1) returned 0x0 [0305.696] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebe0 | out: ppvObject=0x18ebe0*=0x0) returned 0x80004002 [0305.697] IUnknown:Release (This=0x692bc4) returned 0x1 [0305.699] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e548 | out: ppv=0x18e548*=0x586b570) returned 0x0 [0305.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b570, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e764 | out: ppvObject=0x18e764*=0x0) returned 0x80004002 [0305.699] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b570, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e770 | out: ppvObject=0x18e770*=0x6f4860) returned 0x0 [0305.699] WbemDefPath:IUnknown:Release (This=0x586b570) returned 0x0 [0305.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e394 | out: ppvObject=0x18e394*=0x6f4860) returned 0x0 [0305.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e350 | out: ppvObject=0x18e350*=0x0) returned 0x80004002 [0305.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df44 | out: ppvObject=0x18df44*=0x0) returned 0x80004002 [0305.700] WbemDefPath:IUnknown:AddRef (This=0x6f4860) returned 0x3 [0305.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dca4 | out: ppvObject=0x18dca4*=0x0) returned 0x80004002 [0305.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc54 | out: ppvObject=0x18dc54*=0x0) returned 0x80004002 [0305.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc60 | out: ppvObject=0x18dc60*=0x5896c60) returned 0x0 [0305.700] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5896c60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc68 | out: pCid=0x18dc68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0305.700] WbemDefPath:IUnknown:Release (This=0x5896c60) returned 0x3 [0305.700] CoGetContextToken (in: pToken=0x18dcc0 | out: pToken=0x18dcc0) returned 0x0 [0305.701] CoGetContextToken (in: pToken=0x18e0c8 | out: pToken=0x18e0c8) returned 0x0 [0305.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e154 | out: ppvObject=0x18e154*=0x0) returned 0x80004002 [0305.701] WbemDefPath:IUnknown:Release (This=0x6f4860) returned 0x2 [0305.701] WbemDefPath:IUnknown:Release (This=0x6f4860) returned 0x1 [0305.701] CoGetContextToken (in: pToken=0x18ea60 | out: pToken=0x18ea60) returned 0x0 [0305.701] CoGetContextToken (in: pToken=0x18e9c0 | out: pToken=0x18e9c0) returned 0x0 [0305.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4860, riid=0x18ea90*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea8c | out: ppvObject=0x18ea8c*=0x6f4860) returned 0x0 [0305.701] WbemDefPath:IUnknown:AddRef (This=0x6f4860) returned 0x3 [0305.701] WbemDefPath:IUnknown:Release (This=0x6f4860) returned 0x2 [0305.701] WbemDefPath:IWbemPath:SetText (This=0x6f4860, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec10 | out: puCount=0x18ec10*=0x2) returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec0c*=0x0, pszText=0x0 | out: puBuffLength=0x18ec0c*=0xf, pszText=0x0) returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebdc | out: puCount=0x18ebdc*=0x2) returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd8*=0x0, pszText=0x0 | out: puBuffLength=0x18ebd8*=0xf, pszText=0x0) returned 0x0 [0305.702] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebd8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0305.702] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x18ebd8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x240cf10*=0, plFlavor=0x240cf14*=0 | out: pVal=0x18ebd8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x240cf10*=21, plFlavor=0x240cf14*=0) returned 0x0 [0305.702] SysStringByteLen (bstr="2096620") returned 0xe [0305.702] SysStringByteLen (bstr="2096620") returned 0xe [0305.703] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x18ebe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x240cf10*=21, plFlavor=0x240cf14*=0 | out: pVal=0x18ebe0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x240cf10*=21, plFlavor=0x240cf14*=0) returned 0x0 [0305.703] SysStringByteLen (bstr="2096620") returned 0xe [0305.703] SysStringByteLen (bstr="2096620") returned 0xe [0305.710] CoTaskMemAlloc (cb=0x4) returned 0x586b5b0 [0305.710] IEnumWbemClassObject:Next (in: This=0x73c450, lTimeout=-1, uCount=0x1, apObjects=0x586b5b0, puReturned=0x240c684 | out: apObjects=0x586b5b0*=0x0, puReturned=0x240c684*=0x0) returned 0x1 [0305.712] CoTaskMemFree (pv=0x586b5b0) [0305.712] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0305.712] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0305.712] IUnknown:Release (This=0x73c450) returned 0x0 [0305.715] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0305.715] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x1 [0305.715] IUnknown:Release (This=0x73c5e0) returned 0x0 [0305.853] CoTaskMemAlloc (cb=0x20c) returned 0x586ee28 [0305.853] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x586ee28 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0305.859] CoTaskMemFree (pv=0x586ee28) [0305.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0305.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x24, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0305.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0305.859] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0305.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ebb0) returned 1 [0305.860] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x18ec2c | out: lpFileInformation=0x18ec2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0305.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ebac) returned 1 [0305.861] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0305.861] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0305.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb40) returned 1 [0305.868] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x18ebbc | out: lpFileInformation=0x18ebbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0305.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb3c) returned 1 [0305.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb40) returned 1 [0305.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), fInfoLevelId=0x0, lpFileInformation=0x18ebbc | out: lpFileInformation=0x18ebbc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0305.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb3c) returned 1 [0305.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb40) returned 1 [0305.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft"), fInfoLevelId=0x0, lpFileInformation=0x18ebbc | out: lpFileInformation=0x18ebbc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0305.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb3c) returned 1 [0305.875] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws"), lpSecurityAttributes=0x0) returned 1 [0305.997] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0305.997] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe", lpFilePart=0x0) returned 0x39 [0307.827] CoTaskMemAlloc (cb=0x804) returned 0x58a27d8 [0307.827] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x58a27d8, nSize=0x18eca0 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x18eca0) returned 0x1 [0307.829] CoTaskMemFree (pv=0x58a27d8) [0307.830] GetUserNameW (in: lpBuffer=0x18ea34, pcbBuffer=0x18ecac | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x18ecac) returned 1 [0307.871] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec20 | out: puCount=0x18ec20*=0x2) returned 0x0 [0307.876] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec1c*=0x0, pszText=0x0 | out: puBuffLength=0x18ec1c*=0xf, pszText=0x0) returned 0x0 [0307.876] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec1c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec1c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0307.876] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eba8 | out: ppv=0x18eba8*=0x692bc4) returned 0x0 [0307.877] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eba0 | out: pAptType=0x18eba0*=1) returned 0x0 [0307.877] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eba4 | out: ppvObject=0x18eba4*=0x0) returned 0x80004002 [0307.877] IUnknown:Release (This=0x692bc4) returned 0x1 [0307.878] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e7b8 | out: ppv=0x18e7b8*=0x5896bd0) returned 0x0 [0307.878] WbemLocator:IUnknown:QueryInterface (in: This=0x5896bd0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9d4 | out: ppvObject=0x18e9d4*=0x0) returned 0x80004002 [0307.878] WbemLocator:IClassFactory:CreateInstance (in: This=0x5896bd0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9e0 | out: ppvObject=0x18e9e0*=0x586b650) returned 0x0 [0307.878] WbemLocator:IUnknown:Release (This=0x5896bd0) returned 0x0 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e604 | out: ppvObject=0x18e604*=0x586b650) returned 0x0 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5c0 | out: ppvObject=0x18e5c0*=0x0) returned 0x80004002 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1b4 | out: ppvObject=0x18e1b4*=0x0) returned 0x80004002 [0307.879] WbemLocator:IUnknown:AddRef (This=0x586b650) returned 0x3 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df14 | out: ppvObject=0x18df14*=0x0) returned 0x80004002 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dec4 | out: ppvObject=0x18dec4*=0x0) returned 0x80004002 [0307.879] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ded0 | out: ppvObject=0x18ded0*=0x0) returned 0x80004002 [0307.879] CoGetContextToken (in: pToken=0x18df30 | out: pToken=0x18df30) returned 0x0 [0307.879] CoGetContextToken (in: pToken=0x18e338 | out: pToken=0x18e338) returned 0x0 [0307.880] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3c4 | out: ppvObject=0x18e3c4*=0x0) returned 0x80004002 [0307.880] WbemLocator:IUnknown:Release (This=0x586b650) returned 0x2 [0307.880] WbemLocator:IUnknown:Release (This=0x586b650) returned 0x1 [0307.880] CoGetContextToken (in: pToken=0x18e9c0 | out: pToken=0x18e9c0) returned 0x0 [0307.880] CoGetContextToken (in: pToken=0x18e920 | out: pToken=0x18e920) returned 0x0 [0307.880] WbemLocator:IUnknown:QueryInterface (in: This=0x586b650, riid=0x18e9f0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9ec | out: ppvObject=0x18e9ec*=0x586b650) returned 0x0 [0307.880] WbemLocator:IUnknown:AddRef (This=0x586b650) returned 0x3 [0307.880] WbemLocator:IUnknown:Release (This=0x586b650) returned 0x2 [0307.880] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb84 | out: puCount=0x18eb84*=0x2) returned 0x0 [0307.880] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb80*=0x0, pszText=0x0 | out: puBuffLength=0x18eb80*=0xf, pszText=0x0) returned 0x0 [0307.880] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb80*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb80*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0307.880] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea5c | out: ppv=0x18ea5c*=0x586b670) returned 0x0 [0307.881] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b670, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaf0 | out: ppNamespace=0x18eaf0*=0x587edc0) returned 0x0 [0307.922] WbemLocator:IUnknown:QueryInterface (in: This=0x587edc0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x6c1ae4) returned 0x0 [0307.922] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c1ae4, pProxy=0x587edc0, pAuthnSvc=0x18e9d4, pAuthzSvc=0x18e9d0, pServerPrincName=0x18e9c8, pAuthnLevel=0x18e9cc, pImpLevel=0x18e9bc, pAuthInfo=0x18e9c0, pCapabilites=0x18e9c4 | out: pAuthnSvc=0x18e9d4*=0xa, pAuthzSvc=0x18e9d0*=0x0, pServerPrincName=0x18e9c8, pAuthnLevel=0x18e9cc*=0x6, pImpLevel=0x18e9bc*=0x2, pAuthInfo=0x18e9c0, pCapabilites=0x18e9c4*=0x1) returned 0x0 [0307.922] WbemLocator:IUnknown:Release (This=0x6c1ae4) returned 0x1 [0307.922] WbemLocator:IUnknown:QueryInterface (in: This=0x587edc0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e978 | out: ppvObject=0x18e978*=0x6c1b08) returned 0x0 [0307.923] WbemLocator:IUnknown:QueryInterface (in: This=0x587edc0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e964 | out: ppvObject=0x18e964*=0x6c1ae4) returned 0x0 [0307.923] WbemLocator:IClientSecurity:SetBlanket (This=0x6c1ae4, pProxy=0x587edc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0307.923] WbemLocator:IUnknown:Release (This=0x6c1ae4) returned 0x2 [0307.923] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x1 [0307.923] CoTaskMemFree (pv=0x586e9e0) [0307.923] WbemLocator:IUnknown:Release (This=0x586b670) returned 0x0 [0307.923] WbemLocator:IUnknown:QueryInterface (in: This=0x587edc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e574 | out: ppvObject=0x18e574*=0x6c1b08) returned 0x0 [0307.924] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e530 | out: ppvObject=0x18e530*=0x0) returned 0x80004002 [0307.924] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0x0) returned 0x80004002 [0307.925] WbemLocator:IUnknown:QueryInterface (in: This=0x587edc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e124 | out: ppvObject=0x18e124*=0x0) returned 0x80004002 [0307.926] WbemLocator:IUnknown:AddRef (This=0x6c1b08) returned 0x3 [0307.926] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de84 | out: ppvObject=0x18de84*=0x0) returned 0x80004002 [0307.926] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de34 | out: ppvObject=0x18de34*=0x0) returned 0x80004002 [0307.926] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de40 | out: ppvObject=0x18de40*=0x6c1a64) returned 0x0 [0307.926] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1a64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de48 | out: pCid=0x18de48*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0307.926] WbemLocator:IUnknown:Release (This=0x6c1a64) returned 0x3 [0307.926] CoGetContextToken (in: pToken=0x18dea0 | out: pToken=0x18dea0) returned 0x0 [0307.926] CoGetContextToken (in: pToken=0x18e2a8 | out: pToken=0x18e2a8) returned 0x0 [0307.926] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e334 | out: ppvObject=0x18e334*=0x6c1aec) returned 0x0 [0307.926] WbemLocator:IRpcOptions:Query (in: This=0x6c1aec, pPrx=0x6c1b08, dwProperty=2, pdwValue=0x18e340 | out: pdwValue=0x18e340) returned 0x80004002 [0307.926] WbemLocator:IUnknown:Release (This=0x6c1aec) returned 0x3 [0307.926] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x2 [0307.926] CoGetContextToken (in: pToken=0x18e888 | out: pToken=0x18e888) returned 0x0 [0307.927] CoGetContextToken (in: pToken=0x18e7e8 | out: pToken=0x18e7e8) returned 0x0 [0307.927] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x18e8b8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e8b4 | out: ppvObject=0x18e8b4*=0x587edc0) returned 0x0 [0307.927] WbemLocator:IUnknown:AddRef (This=0x587edc0) returned 0x4 [0307.927] WbemLocator:IUnknown:Release (This=0x587edc0) returned 0x3 [0307.927] WbemLocator:IUnknown:Release (This=0x587edc0) returned 0x2 [0307.927] SysStringLen (param_1=0x0) returned 0x0 [0307.927] CoGetContextToken (in: pToken=0x18e888 | out: pToken=0x18e888) returned 0x0 [0307.927] WbemLocator:IUnknown:AddRef (This=0x6c1b08) returned 0x3 [0307.927] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e71c | out: ppvObject=0x18e71c*=0x6c1b08) returned 0x0 [0307.927] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x3 [0307.927] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x2 [0307.927] CoGetContextToken (in: pToken=0x18e980 | out: pToken=0x18e980) returned 0x0 [0307.927] WbemLocator:IUnknown:AddRef (This=0x587edc0) returned 0x3 [0307.927] IWbemServices:ExecQuery (in: This=0x587edc0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_DiskDrive", lFlags=16, pCtx=0x0, ppEnum=0x18eb90 | out: ppEnum=0x18eb90*=0x73bfa0) returned 0x0 [0307.967] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9ec | out: ppvObject=0x18e9ec*=0x73bfa4) returned 0x0 [0307.968] IClientSecurity:QueryBlanket (in: This=0x73bfa4, pProxy=0x73bfa0, pAuthnSvc=0x18ea3c, pAuthzSvc=0x18ea38, pServerPrincName=0x18ea30, pAuthnLevel=0x18ea34, pImpLevel=0x18ea24, pAuthInfo=0x18ea28, pCapabilites=0x18ea2c | out: pAuthnSvc=0x18ea3c*=0xa, pAuthzSvc=0x18ea38*=0x0, pServerPrincName=0x18ea30, pAuthnLevel=0x18ea34*=0x6, pImpLevel=0x18ea24*=0x2, pAuthInfo=0x18ea28, pCapabilites=0x18ea2c*=0x1) returned 0x0 [0307.968] IUnknown:Release (This=0x73bfa4) returned 0x1 [0307.968] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9e0 | out: ppvObject=0x18e9e0*=0x6c1c08) returned 0x0 [0307.968] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9cc | out: ppvObject=0x18e9cc*=0x73bfa4) returned 0x0 [0307.968] IClientSecurity:SetBlanket (This=0x73bfa4, pProxy=0x73bfa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0307.970] IUnknown:Release (This=0x73bfa4) returned 0x2 [0307.970] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0307.970] CoTaskMemFree (pv=0x586eb90) [0307.971] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5d8 | out: ppvObject=0x18e5d8*=0x6c1c08) returned 0x0 [0307.971] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e594 | out: ppvObject=0x18e594*=0x0) returned 0x80004002 [0307.971] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e3b4 | out: ppvObject=0x18e3b4*=0x0) returned 0x80004002 [0307.973] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e18c | out: ppvObject=0x18e18c*=0x0) returned 0x80004002 [0307.974] WbemLocator:IUnknown:AddRef (This=0x6c1c08) returned 0x3 [0307.974] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18deec | out: ppvObject=0x18deec*=0x0) returned 0x80004002 [0307.974] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de9c | out: ppvObject=0x18de9c*=0x0) returned 0x80004002 [0307.974] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dea8 | out: ppvObject=0x18dea8*=0x6c1b64) returned 0x0 [0307.974] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1b64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18deb0 | out: pCid=0x18deb0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0307.974] WbemLocator:IUnknown:Release (This=0x6c1b64) returned 0x3 [0307.974] CoGetContextToken (in: pToken=0x18df08 | out: pToken=0x18df08) returned 0x0 [0307.974] CoGetContextToken (in: pToken=0x18e310 | out: pToken=0x18e310) returned 0x0 [0307.974] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e39c | out: ppvObject=0x18e39c*=0x6c1bec) returned 0x0 [0307.974] WbemLocator:IRpcOptions:Query (in: This=0x6c1bec, pPrx=0x6c1c08, dwProperty=2, pdwValue=0x18e3a8 | out: pdwValue=0x18e3a8) returned 0x80004002 [0307.974] WbemLocator:IUnknown:Release (This=0x6c1bec) returned 0x3 [0307.975] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x2 [0307.975] CoGetContextToken (in: pToken=0x18e8e8 | out: pToken=0x18e8e8) returned 0x0 [0307.975] CoGetContextToken (in: pToken=0x18e848 | out: pToken=0x18e848) returned 0x0 [0307.975] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x18e918*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e914 | out: ppvObject=0x18e914*=0x73bfa0) returned 0x0 [0307.975] IUnknown:AddRef (This=0x73bfa0) returned 0x4 [0307.975] IUnknown:Release (This=0x73bfa0) returned 0x3 [0307.975] IUnknown:Release (This=0x73bfa0) returned 0x2 [0307.975] WbemLocator:IUnknown:Release (This=0x587edc0) returned 0x2 [0307.975] SysStringLen (param_1=0x0) returned 0x0 [0307.975] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebdc | out: puCount=0x18ebdc*=0x2) returned 0x0 [0307.975] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd8*=0x0, pszText=0x0 | out: puBuffLength=0x18ebd8*=0xf, pszText=0x0) returned 0x0 [0307.975] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebd8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebd8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0307.975] CoGetContextToken (in: pToken=0x18ea28 | out: pToken=0x18ea28) returned 0x0 [0307.975] IUnknown:AddRef (This=0x73bfa0) returned 0x3 [0307.976] IEnumWbemClassObject:Clone (in: This=0x73bfa0, ppEnum=0x18ebe8 | out: ppEnum=0x18ebe8*=0x73c130) returned 0x0 [0308.023] IUnknown:QueryInterface (in: This=0x73c130, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18eaa4 | out: ppvObject=0x18eaa4*=0x73c134) returned 0x0 [0308.024] IClientSecurity:QueryBlanket (in: This=0x73c134, pProxy=0x73c130, pAuthnSvc=0x18eaf4, pAuthzSvc=0x18eaf0, pServerPrincName=0x18eae8, pAuthnLevel=0x18eaec, pImpLevel=0x18eadc, pAuthInfo=0x18eae0, pCapabilites=0x18eae4 | out: pAuthnSvc=0x18eaf4*=0xa, pAuthzSvc=0x18eaf0*=0x0, pServerPrincName=0x18eae8, pAuthnLevel=0x18eaec*=0x6, pImpLevel=0x18eadc*=0x2, pAuthInfo=0x18eae0, pCapabilites=0x18eae4*=0x1) returned 0x0 [0308.024] IUnknown:Release (This=0x73c134) returned 0x1 [0308.024] IUnknown:QueryInterface (in: This=0x73c130, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea98 | out: ppvObject=0x18ea98*=0x6c2d08) returned 0x0 [0308.024] IUnknown:QueryInterface (in: This=0x73c130, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea84 | out: ppvObject=0x18ea84*=0x73c134) returned 0x0 [0308.024] IClientSecurity:SetBlanket (This=0x73c134, pProxy=0x73c130, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0308.026] IUnknown:Release (This=0x73c134) returned 0x2 [0308.027] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x1 [0308.027] CoTaskMemFree (pv=0x586e6e0) [0308.027] IUnknown:QueryInterface (in: This=0x73c130, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e680 | out: ppvObject=0x18e680*=0x6c2d08) returned 0x0 [0308.027] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e63c | out: ppvObject=0x18e63c*=0x0) returned 0x80004002 [0308.028] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e45c | out: ppvObject=0x18e45c*=0x0) returned 0x80004002 [0308.029] IUnknown:QueryInterface (in: This=0x73c130, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e234 | out: ppvObject=0x18e234*=0x0) returned 0x80004002 [0308.030] WbemLocator:IUnknown:AddRef (This=0x6c2d08) returned 0x3 [0308.030] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df94 | out: ppvObject=0x18df94*=0x0) returned 0x80004002 [0308.030] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df44 | out: ppvObject=0x18df44*=0x0) returned 0x80004002 [0308.030] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df50 | out: ppvObject=0x18df50*=0x6c2c64) returned 0x0 [0308.030] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2c64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df58 | out: pCid=0x18df58*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0308.030] WbemLocator:IUnknown:Release (This=0x6c2c64) returned 0x3 [0308.030] CoGetContextToken (in: pToken=0x18dfb0 | out: pToken=0x18dfb0) returned 0x0 [0308.031] CoGetContextToken (in: pToken=0x18e3b8 | out: pToken=0x18e3b8) returned 0x0 [0308.031] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e444 | out: ppvObject=0x18e444*=0x6c2cec) returned 0x0 [0308.031] WbemLocator:IRpcOptions:Query (in: This=0x6c2cec, pPrx=0x6c2d08, dwProperty=2, pdwValue=0x18e450 | out: pdwValue=0x18e450) returned 0x80004002 [0308.031] WbemLocator:IUnknown:Release (This=0x6c2cec) returned 0x3 [0308.031] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x2 [0308.031] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0308.031] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0308.031] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x18e9c0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x73c130) returned 0x0 [0308.031] IUnknown:AddRef (This=0x73c130) returned 0x4 [0308.031] IUnknown:Release (This=0x73c130) returned 0x3 [0308.031] IUnknown:Release (This=0x73c130) returned 0x2 [0308.031] IUnknown:Release (This=0x73bfa0) returned 0x2 [0308.031] SysStringLen (param_1=0x0) returned 0x0 [0308.032] IEnumWbemClassObject:Reset (This=0x73c130) returned 0x0 [0308.033] CoTaskMemAlloc (cb=0x4) returned 0x586b7b0 [0308.033] IEnumWbemClassObject:Next (in: This=0x73c130, lTimeout=-1, uCount=0x1, apObjects=0x586b7b0, puReturned=0x24129c8 | out: apObjects=0x586b7b0*=0x58a6dd8, puReturned=0x24129c8*=0x1) returned 0x0 [0308.144] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e240 | out: ppvObject=0x18e240*=0x58a6dd8) returned 0x0 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1fc | out: ppvObject=0x18e1fc*=0x0) returned 0x80004002 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e01c | out: ppvObject=0x18e01c*=0x0) returned 0x80004002 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddf4 | out: ppvObject=0x18ddf4*=0x0) returned 0x80004002 [0308.145] IUnknown:AddRef (This=0x58a6dd8) returned 0x3 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db54 | out: ppvObject=0x18db54*=0x0) returned 0x80004002 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db04 | out: ppvObject=0x18db04*=0x0) returned 0x80004002 [0308.145] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db10 | out: ppvObject=0x18db10*=0x58a6ddc) returned 0x0 [0308.145] IMarshal:GetUnmarshalClass (in: This=0x58a6ddc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18db18 | out: pCid=0x18db18*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0308.145] IUnknown:Release (This=0x58a6ddc) returned 0x3 [0308.145] CoGetContextToken (in: pToken=0x18db70 | out: pToken=0x18db70) returned 0x0 [0308.145] CoGetContextToken (in: pToken=0x18df78 | out: pToken=0x18df78) returned 0x0 [0308.146] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e004 | out: ppvObject=0x18e004*=0x0) returned 0x80004002 [0308.146] IUnknown:Release (This=0x58a6dd8) returned 0x2 [0308.146] CoGetContextToken (in: pToken=0x18e550 | out: pToken=0x18e550) returned 0x0 [0308.146] CoGetContextToken (in: pToken=0x18e4b0 | out: pToken=0x18e4b0) returned 0x0 [0308.146] IUnknown:QueryInterface (in: This=0x58a6dd8, riid=0x18e580*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e57c | out: ppvObject=0x18e57c*=0x58a6dd8) returned 0x0 [0308.146] IUnknown:AddRef (This=0x58a6dd8) returned 0x4 [0308.146] IUnknown:Release (This=0x58a6dd8) returned 0x3 [0308.146] IUnknown:Release (This=0x58a6dd8) returned 0x2 [0308.146] CoTaskMemFree (pv=0x586b7b0) [0308.146] CoGetContextToken (in: pToken=0x18e8c8 | out: pToken=0x18e8c8) returned 0x0 [0308.146] IUnknown:AddRef (This=0x58a6dd8) returned 0x3 [0308.146] IWbemClassObject:Get (in: This=0x58a6dd8, wszName="__GENUS", lFlags=0, pVal=0x18ebd8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec58*=0, plFlavor=0x18ec54*=0 | out: pVal=0x18ebd8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec58*=3, plFlavor=0x18ec54*=64) returned 0x0 [0308.147] IWbemClassObject:Get (in: This=0x58a6dd8, wszName="__PATH", lFlags=0, pVal=0x18ebbc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec40*=0, plFlavor=0x18ec3c*=0 | out: pVal=0x18ebbc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"", varVal2=0x0), pType=0x18ec40*=8, plFlavor=0x18ec3c*=64) returned 0x0 [0308.147] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0308.147] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0308.147] CoGetObjectContext (in: riid=0x227a150*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebe8 | out: ppv=0x18ebe8*=0x692bc4) returned 0x0 [0308.147] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebe0 | out: pAptType=0x18ebe0*=1) returned 0x0 [0308.147] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x227a138*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebe4 | out: ppvObject=0x18ebe4*=0x0) returned 0x80004002 [0308.147] IUnknown:Release (This=0x692bc4) returned 0x1 [0308.148] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e550 | out: ppv=0x18e550*=0x586b7e0) returned 0x0 [0308.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b7e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e76c | out: ppvObject=0x18e76c*=0x0) returned 0x80004002 [0308.148] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b7e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e778 | out: ppvObject=0x18e778*=0x6f54a0) returned 0x0 [0308.148] WbemDefPath:IUnknown:Release (This=0x586b7e0) returned 0x0 [0308.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e39c | out: ppvObject=0x18e39c*=0x6f54a0) returned 0x0 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e358 | out: ppvObject=0x18e358*=0x0) returned 0x80004002 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0308.149] WbemDefPath:IUnknown:AddRef (This=0x6f54a0) returned 0x3 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dcac | out: ppvObject=0x18dcac*=0x0) returned 0x80004002 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc5c | out: ppvObject=0x18dc5c*=0x0) returned 0x80004002 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc68 | out: ppvObject=0x18dc68*=0x58972d8) returned 0x0 [0308.149] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58972d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc70 | out: pCid=0x18dc70*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0308.149] WbemDefPath:IUnknown:Release (This=0x58972d8) returned 0x3 [0308.149] CoGetContextToken (in: pToken=0x18dcc8 | out: pToken=0x18dcc8) returned 0x0 [0308.149] CoGetContextToken (in: pToken=0x18e0d0 | out: pToken=0x18e0d0) returned 0x0 [0308.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e15c | out: ppvObject=0x18e15c*=0x0) returned 0x80004002 [0308.154] WbemDefPath:IUnknown:Release (This=0x6f54a0) returned 0x2 [0308.154] WbemDefPath:IUnknown:Release (This=0x6f54a0) returned 0x1 [0308.154] CoGetContextToken (in: pToken=0x18ea60 | out: pToken=0x18ea60) returned 0x0 [0308.154] CoGetContextToken (in: pToken=0x18e9c0 | out: pToken=0x18e9c0) returned 0x0 [0308.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f54a0, riid=0x18ea90*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea8c | out: ppvObject=0x18ea8c*=0x6f54a0) returned 0x0 [0308.154] WbemDefPath:IUnknown:AddRef (This=0x6f54a0) returned 0x3 [0308.154] WbemDefPath:IUnknown:Release (This=0x6f54a0) returned 0x2 [0308.154] WbemDefPath:IWbemPath:SetText (This=0x6f54a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ec14 | out: puCount=0x18ec14*=0x2) returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec10*=0x0, pszText=0x0 | out: puBuffLength=0x18ec10*=0xf, pszText=0x0) returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ec10*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ec10*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe0 | out: puCount=0x18ebe0*=0x2) returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebdc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebdc*=0xf, pszText=0x0) returned 0x0 [0308.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebdc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebdc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0308.155] IWbemClassObject:Get (in: This=0x58a6dd8, wszName="SerialNumber", lFlags=0, pVal=0x18ebdc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24131f8*=0, plFlavor=0x24131fc*=0 | out: pVal=0x18ebdc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LSML8SFPHCNE5SL", varVal2=0x0), pType=0x24131f8*=8, plFlavor=0x24131fc*=0) returned 0x0 [0308.155] SysStringByteLen (bstr="LSML8SFPHCNE5SL") returned 0x1e [0308.155] SysStringByteLen (bstr="LSML8SFPHCNE5SL") returned 0x1e [0308.155] IWbemClassObject:Get (in: This=0x58a6dd8, wszName="SerialNumber", lFlags=0, pVal=0x18ebe4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24131f8*=8, plFlavor=0x24131fc*=0 | out: pVal=0x18ebe4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="LSML8SFPHCNE5SL", varVal2=0x0), pType=0x24131f8*=8, plFlavor=0x24131fc*=0) returned 0x0 [0308.155] SysStringByteLen (bstr="LSML8SFPHCNE5SL") returned 0x1e [0308.156] SysStringByteLen (bstr="LSML8SFPHCNE5SL") returned 0x1e [0308.156] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0308.156] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x1 [0308.156] IUnknown:Release (This=0x73c130) returned 0x0 [0308.158] CoGetContextToken (in: pToken=0x18eb08 | out: pToken=0x18eb08) returned 0x0 [0308.158] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0308.158] IUnknown:Release (This=0x73bfa0) returned 0x0 [0308.215] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x18ec7c | out: pfEnabled=0x18ec7c) returned 0x0 [0308.544] GetSystemMetrics (nIndex=78) returned 1440 [0308.544] GetSystemMetrics (nIndex=79) returned 900 [0308.598] GetUserNameW (in: lpBuffer=0x18ea40, pcbBuffer=0x18ecb8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x18ecb8) returned 1 [0308.624] GetCurrentProcess () returned 0xffffffff [0308.624] GetCurrentThread () returned 0xfffffffe [0308.624] GetCurrentProcess () returned 0xffffffff [0308.624] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x18ec74, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x18ec74*=0x6ac) returned 1 [0308.624] GetCurrentThreadId () returned 0x1350 [0308.624] OleInitialize (pvReserved=0x0) returned 0x80010106 [0308.630] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0308.659] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76b60000 [0308.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IsWow64Process", cchWideChar=14, lpMultiByteStr=0x18ec20, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsWow64ProcessLn2÷n\x9c(ú5oÀî\x18", lpUsedDefaultChar=0x0) returned 14 [0308.660] GetProcAddress (hModule=0x76b60000, lpProcName="IsWow64Process") returned 0x76b79f10 [0308.660] GetCurrentProcess () returned 0xffffffff [0308.660] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x18ec80 | out: Wow64Process=0x18ec80*=1) returned 1 [0308.675] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec1c | out: phkResult=0x18ec1c*=0x69c) returned 0x0 [0308.675] RegQueryValueExW (in: hKey=0x69c, lpValueName="ProductName", lpReserved=0x0, lpType=0x18ec3c, lpData=0x0, lpcbData=0x18ec38*=0x0 | out: lpType=0x18ec3c*=0x1, lpData=0x0, lpcbData=0x18ec38*=0x1e) returned 0x0 [0308.676] RegQueryValueExW (in: hKey=0x69c, lpValueName="ProductName", lpReserved=0x0, lpType=0x18ec3c, lpData=0x2414a8c, lpcbData=0x18ec38*=0x1e | out: lpType=0x18ec3c*=0x1, lpData="Windows 10 Pro", lpcbData=0x18ec38*=0x1e) returned 0x0 [0308.676] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ec1c | out: phkResult=0x18ec1c*=0x6b0) returned 0x0 [0308.676] RegQueryValueExW (in: hKey=0x6b0, lpValueName="CSDVersion", lpReserved=0x0, lpType=0x18ec3c, lpData=0x0, lpcbData=0x18ec38*=0x0 | out: lpType=0x18ec3c*=0x0, lpData=0x0, lpcbData=0x18ec38*=0x0) returned 0x2 [0308.786] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0308.786] GetKeyboardLayoutList (in: nBuff=1, lpList=0x2414e88 | out: lpList=0x2414e88) returned 1 [0308.973] ExpandEnvironmentStringsW (in: lpSrc="%AWS_ACCESS_KEY_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AWS_ACCESS_KEY_ID%") returned 0x14 [0308.973] ExpandEnvironmentStringsW (in: lpSrc="%AWS_ACCESS_KEY_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AWS_ACCESS_KEY_ID%") returned 0x14 [0308.973] ExpandEnvironmentStringsW (in: lpSrc="%AWS_SECRET_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AWS_SECRET_ACCESS_KEY%") returned 0x18 [0308.973] ExpandEnvironmentStringsW (in: lpSrc="%AWS_SECRET_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AWS_SECRET_ACCESS_KEY%") returned 0x18 [0308.973] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_ACCESS_KEY_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AMAZON_AWS_ACCESS_KEY_ID%") returned 0x1b [0308.974] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_ACCESS_KEY_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AMAZON_AWS_ACCESS_KEY_ID%") returned 0x1b [0308.974] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_SECRET_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AMAZON_AWS_SECRET_ACCESS_KEY%") returned 0x1f [0308.974] ExpandEnvironmentStringsW (in: lpSrc="%AMAZON_AWS_SECRET_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AMAZON_AWS_SECRET_ACCESS_KEY%") returned 0x1f [0308.974] ExpandEnvironmentStringsW (in: lpSrc="%ALGOLIA_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%ALGOLIA_API_KEY%") returned 0x12 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%ALGOLIA_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%ALGOLIA_API_KEY%") returned 0x12 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_CLIENT_ID%") returned 0x12 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_CLIENT_ID%") returned 0x12 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_CLIENT_SECRET%") returned 0x16 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_CLIENT_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_CLIENT_SECRET%") returned 0x16 [0308.975] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_USERNAME%") returned 0x11 [0308.976] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_USERNAME%") returned 0x11 [0308.976] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_PASSWORD%") returned 0x11 [0308.976] ExpandEnvironmentStringsW (in: lpSrc="%AZURE_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%AZURE_PASSWORD%") returned 0x11 [0308.976] ExpandEnvironmentStringsW (in: lpSrc="%MSI_ENDPOINT%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MSI_ENDPOINT%") returned 0xf [0308.976] ExpandEnvironmentStringsW (in: lpSrc="%MSI_ENDPOINT%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MSI_ENDPOINT%") returned 0xf [0308.977] ExpandEnvironmentStringsW (in: lpSrc="%MSI_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MSI_SECRET%") returned 0xd [0308.977] ExpandEnvironmentStringsW (in: lpSrc="%MSI_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MSI_SECRET%") returned 0xd [0308.977] ExpandEnvironmentStringsW (in: lpSrc="%binance_api%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%binance_api%") returned 0xe [0308.977] ExpandEnvironmentStringsW (in: lpSrc="%binance_api%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%binance_api%") returned 0xe [0308.977] ExpandEnvironmentStringsW (in: lpSrc="%binance_secret%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%binance_secret%") returned 0x11 [0308.978] ExpandEnvironmentStringsW (in: lpSrc="%binance_secret%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%binance_secret%") returned 0x11 [0308.978] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%BITTREX_API_KEY%") returned 0x12 [0308.978] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%BITTREX_API_KEY%") returned 0x12 [0308.978] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%BITTREX_API_SECRET%") returned 0x15 [0308.978] ExpandEnvironmentStringsW (in: lpSrc="%BITTREX_API_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%BITTREX_API_SECRET%") returned 0x15 [0308.979] ExpandEnvironmentStringsW (in: lpSrc="%CF_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CF_PASSWORD%") returned 0xe [0308.979] ExpandEnvironmentStringsW (in: lpSrc="%CF_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CF_PASSWORD%") returned 0xe [0308.979] ExpandEnvironmentStringsW (in: lpSrc="%CF_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CF_USERNAME%") returned 0xe [0308.979] ExpandEnvironmentStringsW (in: lpSrc="%CF_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CF_USERNAME%") returned 0xe [0308.979] ExpandEnvironmentStringsW (in: lpSrc="%CODECLIMATE_REPO_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CODECLIMATE_REPO_TOKEN%") returned 0x19 [0308.980] ExpandEnvironmentStringsW (in: lpSrc="%CODECLIMATE_REPO_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CODECLIMATE_REPO_TOKEN%") returned 0x19 [0308.980] ExpandEnvironmentStringsW (in: lpSrc="%COVERALLS_REPO_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%COVERALLS_REPO_TOKEN%") returned 0x17 [0308.980] ExpandEnvironmentStringsW (in: lpSrc="%COVERALLS_REPO_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%COVERALLS_REPO_TOKEN%") returned 0x17 [0308.980] ExpandEnvironmentStringsW (in: lpSrc="%CIRCLE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CIRCLE_TOKEN%") returned 0xf [0309.031] ExpandEnvironmentStringsW (in: lpSrc="%CIRCLE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CIRCLE_TOKEN%") returned 0xf [0309.032] ExpandEnvironmentStringsW (in: lpSrc="%DIGITALOCEAN_ACCESS_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DIGITALOCEAN_ACCESS_TOKEN%") returned 0x1c [0309.032] ExpandEnvironmentStringsW (in: lpSrc="%DIGITALOCEAN_ACCESS_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DIGITALOCEAN_ACCESS_TOKEN%") returned 0x1c [0309.032] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_EMAIL%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_EMAIL%") returned 0xf [0309.032] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_EMAIL%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_EMAIL%") returned 0xf [0309.032] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_PASSWORD%") returned 0x12 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_PASSWORD%") returned 0x12 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_USERNAME%") returned 0x12 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%DOCKER_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKER_USERNAME%") returned 0x12 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%DOCKERHUB_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKERHUB_PASSWORD%") returned 0x15 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%DOCKERHUB_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%DOCKERHUB_PASSWORD%") returned 0x15 [0309.033] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_APP_ID%") returned 0x12 [0309.034] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_ID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_APP_ID%") returned 0x12 [0309.034] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_APP_SECRET%") returned 0x16 [0309.034] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_APP_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_APP_SECRET%") returned 0x16 [0309.035] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_ACCESS_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_ACCESS_TOKEN%") returned 0x18 [0309.035] ExpandEnvironmentStringsW (in: lpSrc="%FACEBOOK_ACCESS_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FACEBOOK_ACCESS_TOKEN%") returned 0x18 [0309.035] ExpandEnvironmentStringsW (in: lpSrc="%FIREBASE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FIREBASE_TOKEN%") returned 0x11 [0309.035] ExpandEnvironmentStringsW (in: lpSrc="%FIREBASE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FIREBASE_TOKEN%") returned 0x11 [0309.035] ExpandEnvironmentStringsW (in: lpSrc="%FOSSA_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FOSSA_API_KEY%") returned 0x10 [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%FOSSA_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%FOSSA_API_KEY%") returned 0x10 [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%GH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GH_TOKEN%") returned 0xb [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%GH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GH_TOKEN%") returned 0xb [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%GH_ENTERPRISE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GH_ENTERPRISE_TOKEN%") returned 0x16 [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%GH_ENTERPRISE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GH_ENTERPRISE_TOKEN%") returned 0x16 [0309.036] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0309.037] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0309.037] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0309.037] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0309.037] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_APPLICATION_CREDENTIALS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GOOGLE_APPLICATION_CREDENTIALS%") returned 0x21 [0309.037] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_APPLICATION_CREDENTIALS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GOOGLE_APPLICATION_CREDENTIALS%") returned 0x21 [0309.038] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GOOGLE_API_KEY%") returned 0x11 [0309.038] ExpandEnvironmentStringsW (in: lpSrc="%GOOGLE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GOOGLE_API_KEY%") returned 0x11 [0309.038] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0309.038] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_USER%") returned 0x11 [0309.038] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%CI_DEPLOY_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_DEPLOY_PASSWORD%") returned 0x15 [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%GITLAB_USER_LOGIN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GITLAB_USER_LOGIN%") returned 0x14 [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%GITLAB_USER_LOGIN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%GITLAB_USER_LOGIN%") returned 0x14 [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_JWT%") returned 0xd [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_JWT%") returned 0xd [0309.039] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT_V2%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_JWT_V2%") returned 0x10 [0309.040] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_JWT_V2%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_JWT_V2%") returned 0x10 [0309.040] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_TOKEN%") returned 0xf [0309.040] ExpandEnvironmentStringsW (in: lpSrc="%CI_JOB_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CI_JOB_TOKEN%") returned 0xf [0309.040] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%HEROKU_API_KEY%") returned 0x11 [0309.040] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%HEROKU_API_KEY%") returned 0x11 [0309.041] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%HEROKU_API_USER%") returned 0x12 [0309.041] ExpandEnvironmentStringsW (in: lpSrc="%HEROKU_API_USER%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%HEROKU_API_USER%") returned 0x12 [0309.041] ExpandEnvironmentStringsW (in: lpSrc="%MAILGUN_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MAILGUN_API_KEY%") returned 0x12 [0309.041] ExpandEnvironmentStringsW (in: lpSrc="%MAILGUN_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MAILGUN_API_KEY%") returned 0x12 [0309.041] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PRIVATE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MCLI_PRIVATE_API_KEY%") returned 0x17 [0309.042] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PRIVATE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MCLI_PRIVATE_API_KEY%") returned 0x17 [0309.042] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PUBLIC_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MCLI_PUBLIC_API_KEY%") returned 0x16 [0309.042] ExpandEnvironmentStringsW (in: lpSrc="%MCLI_PUBLIC_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%MCLI_PUBLIC_API_KEY%") returned 0x16 [0309.042] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NGROK_TOKEN%") returned 0xe [0309.042] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NGROK_TOKEN%") returned 0xe [0309.043] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NGROK_AUTH_TOKEN%") returned 0x13 [0309.043] ExpandEnvironmentStringsW (in: lpSrc="%NGROK_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NGROK_AUTH_TOKEN%") returned 0x13 [0309.043] ExpandEnvironmentStringsW (in: lpSrc="%NPM_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NPM_AUTH_TOKEN%") returned 0x11 [0309.045] ExpandEnvironmentStringsW (in: lpSrc="%NPM_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%NPM_AUTH_TOKEN%") returned 0x11 [0309.045] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_ORGURL%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_CLIENT_ORGURL%") returned 0x15 [0309.045] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_ORGURL%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_CLIENT_ORGURL%") returned 0x15 [0309.047] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_CLIENT_TOKEN%") returned 0x14 [0309.047] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_CLIENT_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_CLIENT_TOKEN%") returned 0x14 [0309.047] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTSECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTSECRET%") returned 0x1b [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTSECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTSECRET%") returned 0x1b [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTID%") returned 0x17 [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_OAUTH2_CLIENTID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_OAUTH2_CLIENTID%") returned 0x17 [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_AUTHN_GROUPID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_AUTHN_GROUPID%") returned 0x15 [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OKTA_AUTHN_GROUPID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OKTA_AUTHN_GROUPID%") returned 0x15 [0309.048] ExpandEnvironmentStringsW (in: lpSrc="%OS_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OS_USERNAME%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%OS_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OS_USERNAME%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%OS_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OS_PASSWORD%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%OS_PASSWORD%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%OS_PASSWORD%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%PERCY_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%PERCY_TOKEN%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%PERCY_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%PERCY_TOKEN%") returned 0xe [0309.049] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SAUCE_ACCESS_KEY%") returned 0x13 [0309.050] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_ACCESS_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SAUCE_ACCESS_KEY%") returned 0x13 [0309.050] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SAUCE_USERNAME%") returned 0x11 [0309.050] ExpandEnvironmentStringsW (in: lpSrc="%SAUCE_USERNAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SAUCE_USERNAME%") returned 0x11 [0309.050] ExpandEnvironmentStringsW (in: lpSrc="%SENTRY_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SENTRY_AUTH_TOKEN%") returned 0x14 [0309.050] ExpandEnvironmentStringsW (in: lpSrc="%SENTRY_AUTH_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SENTRY_AUTH_TOKEN%") returned 0x14 [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%SLACK_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SLACK_TOKEN%") returned 0xe [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%SLACK_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SLACK_TOKEN%") returned 0xe [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%square_access_token%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%square_access_token%") returned 0x16 [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%square_access_token%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%square_access_token%") returned 0x16 [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%square_oauth_secret%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%square_oauth_secret%") returned 0x16 [0309.051] ExpandEnvironmentStringsW (in: lpSrc="%square_oauth_secret%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%square_oauth_secret%") returned 0x16 [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%STRIPE_API_KEY%") returned 0x11 [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_API_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%STRIPE_API_KEY%") returned 0x11 [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_DEVICE_NAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%STRIPE_DEVICE_NAME%") returned 0x15 [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%STRIPE_DEVICE_NAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%STRIPE_DEVICE_NAME%") returned 0x15 [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SURGE_TOKEN%") returned 0xe [0309.052] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SURGE_TOKEN%") returned 0xe [0309.053] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_LOGIN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SURGE_LOGIN%") returned 0xe [0309.053] ExpandEnvironmentStringsW (in: lpSrc="%SURGE_LOGIN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%SURGE_LOGIN%") returned 0xe [0309.053] ExpandEnvironmentStringsW (in: lpSrc="%TWILIO_ACCOUNT_SID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TWILIO_ACCOUNT_SID%") returned 0x15 [0309.053] ExpandEnvironmentStringsW (in: lpSrc="%TWILIO_ACCOUNT_SID%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TWILIO_ACCOUNT_SID%") returned 0x15 [0309.054] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CONSUMER_KEY%") returned 0xf [0309.054] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CONSUMER_KEY%") returned 0xf [0309.054] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CONSUMER_SECRET%") returned 0x12 [0309.054] ExpandEnvironmentStringsW (in: lpSrc="%CONSUMER_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%CONSUMER_SECRET%") returned 0x12 [0309.054] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SUDO%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_SUDO%") returned 0xe [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SUDO%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_SUDO%") returned 0xe [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_OS_NAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_OS_NAME%") returned 0x11 [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_OS_NAME%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_OS_NAME%") returned 0x11 [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SECURE_ENV_VARS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_SECURE_ENV_VARS%") returned 0x19 [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%TRAVIS_SECURE_ENV_VARS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TRAVIS_SECURE_ENV_VARS%") returned 0x19 [0309.055] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VAULT_TOKEN%") returned 0xe [0309.056] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VAULT_TOKEN%") returned 0xe [0309.056] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_CLIENT_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VAULT_CLIENT_KEY%") returned 0x13 [0309.056] ExpandEnvironmentStringsW (in: lpSrc="%VAULT_CLIENT_KEY%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VAULT_CLIENT_KEY%") returned 0x13 [0309.056] ExpandEnvironmentStringsW (in: lpSrc="%TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TOKEN%") returned 0x8 [0309.057] ExpandEnvironmentStringsW (in: lpSrc="%TOKEN%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%TOKEN%") returned 0x8 [0309.057] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_ACCESS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VULTR_ACCESS%") returned 0xf [0309.057] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_ACCESS%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VULTR_ACCESS%") returned 0xf [0309.057] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VULTR_SECRET%") returned 0xf [0309.057] ExpandEnvironmentStringsW (in: lpSrc="%VULTR_SECRET%", lpDst=0x18eae8, nSize=0x64 | out: lpDst="%VULTR_SECRET%") returned 0xf [0309.248] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebb4 | out: phkResult=0x18ebb4*=0x0) returned 0x2 [0309.589] GetCurrentProcessId () returned 0xad0 [0309.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32454f0, Length=0x20000, ResultLength=0x18eb68 | out: SystemInformation=0x32454f0, ResultLength=0x18eb68*=0x14b50) returned 0x0 [0309.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb50 | out: puCount=0x18eb50*=0x2) returned 0x0 [0309.848] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb4c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb4c*=0xf, pszText=0x0) returned 0x0 [0309.848] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb4c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb4c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0309.848] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ead8 | out: ppv=0x18ead8*=0x692bc4) returned 0x0 [0309.849] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ead0 | out: pAptType=0x18ead0*=1) returned 0x0 [0309.849] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ead4 | out: ppvObject=0x18ead4*=0x0) returned 0x80004002 [0309.849] IUnknown:Release (This=0x692bc4) returned 0x1 [0309.852] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e6e8 | out: ppv=0x18e6e8*=0x5896be8) returned 0x0 [0309.853] WbemLocator:IUnknown:QueryInterface (in: This=0x5896be8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e904 | out: ppvObject=0x18e904*=0x0) returned 0x80004002 [0309.853] WbemLocator:IClassFactory:CreateInstance (in: This=0x5896be8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e910 | out: ppvObject=0x18e910*=0x586b710) returned 0x0 [0309.853] WbemLocator:IUnknown:Release (This=0x5896be8) returned 0x0 [0309.853] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e534 | out: ppvObject=0x18e534*=0x586b710) returned 0x0 [0309.853] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4f0 | out: ppvObject=0x18e4f0*=0x0) returned 0x80004002 [0309.853] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0e4 | out: ppvObject=0x18e0e4*=0x0) returned 0x80004002 [0309.854] WbemLocator:IUnknown:AddRef (This=0x586b710) returned 0x3 [0309.854] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de44 | out: ppvObject=0x18de44*=0x0) returned 0x80004002 [0309.854] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18ddf4 | out: ppvObject=0x18ddf4*=0x0) returned 0x80004002 [0309.854] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de00 | out: ppvObject=0x18de00*=0x0) returned 0x80004002 [0309.854] CoGetContextToken (in: pToken=0x18de60 | out: pToken=0x18de60) returned 0x0 [0309.854] CoGetContextToken (in: pToken=0x18e268 | out: pToken=0x18e268) returned 0x0 [0309.854] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0309.854] WbemLocator:IUnknown:Release (This=0x586b710) returned 0x2 [0309.854] WbemLocator:IUnknown:Release (This=0x586b710) returned 0x1 [0309.854] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0309.854] CoGetContextToken (in: pToken=0x18e850 | out: pToken=0x18e850) returned 0x0 [0309.859] WbemLocator:IUnknown:QueryInterface (in: This=0x586b710, riid=0x18e920*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x586b710) returned 0x0 [0309.859] WbemLocator:IUnknown:AddRef (This=0x586b710) returned 0x3 [0309.859] WbemLocator:IUnknown:Release (This=0x586b710) returned 0x2 [0309.859] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eab4 | out: puCount=0x18eab4*=0x2) returned 0x0 [0309.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eab0*=0x0, pszText=0x0 | out: puBuffLength=0x18eab0*=0xf, pszText=0x0) returned 0x0 [0309.859] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eab0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eab0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0309.859] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18e98c | out: ppv=0x18e98c*=0x586b740) returned 0x0 [0309.859] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b740, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18ea20 | out: ppNamespace=0x18ea20*=0x587e7d0) returned 0x0 [0310.051] WbemLocator:IUnknown:QueryInterface (in: This=0x587e7d0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8b4 | out: ppvObject=0x18e8b4*=0x6c18e4) returned 0x0 [0310.051] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c18e4, pProxy=0x587e7d0, pAuthnSvc=0x18e904, pAuthzSvc=0x18e900, pServerPrincName=0x18e8f8, pAuthnLevel=0x18e8fc, pImpLevel=0x18e8ec, pAuthInfo=0x18e8f0, pCapabilites=0x18e8f4 | out: pAuthnSvc=0x18e904*=0xa, pAuthzSvc=0x18e900*=0x0, pServerPrincName=0x18e8f8, pAuthnLevel=0x18e8fc*=0x6, pImpLevel=0x18e8ec*=0x2, pAuthInfo=0x18e8f0, pCapabilites=0x18e8f4*=0x1) returned 0x0 [0310.051] WbemLocator:IUnknown:Release (This=0x6c18e4) returned 0x1 [0310.051] WbemLocator:IUnknown:QueryInterface (in: This=0x587e7d0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8a8 | out: ppvObject=0x18e8a8*=0x6c1908) returned 0x0 [0310.051] WbemLocator:IUnknown:QueryInterface (in: This=0x587e7d0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e894 | out: ppvObject=0x18e894*=0x6c18e4) returned 0x0 [0310.051] WbemLocator:IClientSecurity:SetBlanket (This=0x6c18e4, pProxy=0x587e7d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0310.052] WbemLocator:IUnknown:Release (This=0x6c18e4) returned 0x2 [0310.052] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x1 [0310.052] CoTaskMemFree (pv=0x586ebc0) [0310.052] WbemLocator:IUnknown:Release (This=0x586b740) returned 0x0 [0310.052] WbemLocator:IUnknown:QueryInterface (in: This=0x587e7d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4a4 | out: ppvObject=0x18e4a4*=0x6c1908) returned 0x0 [0310.052] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e460 | out: ppvObject=0x18e460*=0x0) returned 0x80004002 [0310.062] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e27c | out: ppvObject=0x18e27c*=0x0) returned 0x80004002 [0310.064] WbemLocator:IUnknown:QueryInterface (in: This=0x587e7d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e054 | out: ppvObject=0x18e054*=0x0) returned 0x80004002 [0310.068] WbemLocator:IUnknown:AddRef (This=0x6c1908) returned 0x3 [0310.068] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddb4 | out: ppvObject=0x18ddb4*=0x0) returned 0x80004002 [0310.068] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dd64 | out: ppvObject=0x18dd64*=0x0) returned 0x80004002 [0310.068] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dd70 | out: ppvObject=0x18dd70*=0x6c1864) returned 0x0 [0310.069] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dd78 | out: pCid=0x18dd78*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0310.069] WbemLocator:IUnknown:Release (This=0x6c1864) returned 0x3 [0310.069] CoGetContextToken (in: pToken=0x18ddd0 | out: pToken=0x18ddd0) returned 0x0 [0310.069] CoGetContextToken (in: pToken=0x18e1d8 | out: pToken=0x18e1d8) returned 0x0 [0310.069] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e264 | out: ppvObject=0x18e264*=0x6c18ec) returned 0x0 [0310.069] WbemLocator:IRpcOptions:Query (in: This=0x6c18ec, pPrx=0x6c1908, dwProperty=2, pdwValue=0x18e270 | out: pdwValue=0x18e270) returned 0x80004002 [0310.069] WbemLocator:IUnknown:Release (This=0x6c18ec) returned 0x3 [0310.070] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x2 [0310.070] CoGetContextToken (in: pToken=0x18e7b8 | out: pToken=0x18e7b8) returned 0x0 [0310.070] CoGetContextToken (in: pToken=0x18e718 | out: pToken=0x18e718) returned 0x0 [0310.070] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x18e7e8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e7e4 | out: ppvObject=0x18e7e4*=0x587e7d0) returned 0x0 [0310.070] WbemLocator:IUnknown:AddRef (This=0x587e7d0) returned 0x4 [0310.070] WbemLocator:IUnknown:Release (This=0x587e7d0) returned 0x3 [0310.070] WbemLocator:IUnknown:Release (This=0x587e7d0) returned 0x2 [0310.070] SysStringLen (param_1=0x0) returned 0x0 [0310.070] CoGetContextToken (in: pToken=0x18e7b8 | out: pToken=0x18e7b8) returned 0x0 [0310.070] WbemLocator:IUnknown:AddRef (This=0x6c1908) returned 0x3 [0310.070] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1908, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e64c | out: ppvObject=0x18e64c*=0x6c1908) returned 0x0 [0310.070] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x3 [0310.071] WbemLocator:IUnknown:Release (This=0x6c1908) returned 0x2 [0310.071] CoGetContextToken (in: pToken=0x18e890 | out: pToken=0x18e890) returned 0x0 [0310.071] WbemLocator:IUnknown:AddRef (This=0x587e7d0) returned 0x3 [0310.071] IWbemServices:ExecQuery (in: This=0x587e7d0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x18eac0 | out: ppEnum=0x18eac0*=0x73c900) returned 0x0 [0310.140] IUnknown:QueryInterface (in: This=0x73c900, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8f8 | out: ppvObject=0x18e8f8*=0x73c904) returned 0x0 [0310.141] IClientSecurity:QueryBlanket (in: This=0x73c904, pProxy=0x73c900, pAuthnSvc=0x18e948, pAuthzSvc=0x18e944, pServerPrincName=0x18e93c, pAuthnLevel=0x18e940, pImpLevel=0x18e930, pAuthInfo=0x18e934, pCapabilites=0x18e938 | out: pAuthnSvc=0x18e948*=0xa, pAuthzSvc=0x18e944*=0x0, pServerPrincName=0x18e93c, pAuthnLevel=0x18e940*=0x6, pImpLevel=0x18e930*=0x2, pAuthInfo=0x18e934, pCapabilites=0x18e938*=0x1) returned 0x0 [0310.141] IUnknown:Release (This=0x73c904) returned 0x1 [0310.141] IUnknown:QueryInterface (in: This=0x73c900, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8ec | out: ppvObject=0x18e8ec*=0x6c2f08) returned 0x0 [0310.141] IUnknown:QueryInterface (in: This=0x73c900, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e8d8 | out: ppvObject=0x18e8d8*=0x73c904) returned 0x0 [0310.141] IClientSecurity:SetBlanket (This=0x73c904, pProxy=0x73c900, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0310.144] IUnknown:Release (This=0x73c904) returned 0x2 [0310.144] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x1 [0310.144] CoTaskMemFree (pv=0x586e8c0) [0310.145] IUnknown:QueryInterface (in: This=0x73c900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e4e4 | out: ppvObject=0x18e4e4*=0x6c2f08) returned 0x0 [0310.145] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4a0 | out: ppvObject=0x18e4a0*=0x0) returned 0x80004002 [0310.146] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2bc | out: ppvObject=0x18e2bc*=0x0) returned 0x80004002 [0310.147] IUnknown:QueryInterface (in: This=0x73c900, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e094 | out: ppvObject=0x18e094*=0x0) returned 0x80004002 [0310.148] WbemLocator:IUnknown:AddRef (This=0x6c2f08) returned 0x3 [0310.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18ddf4 | out: ppvObject=0x18ddf4*=0x0) returned 0x80004002 [0310.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dda4 | out: ppvObject=0x18dda4*=0x0) returned 0x80004002 [0310.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ddb0 | out: ppvObject=0x18ddb0*=0x6c2e64) returned 0x0 [0310.148] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2e64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddb8 | out: pCid=0x18ddb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0310.148] WbemLocator:IUnknown:Release (This=0x6c2e64) returned 0x3 [0310.148] CoGetContextToken (in: pToken=0x18de10 | out: pToken=0x18de10) returned 0x0 [0310.148] CoGetContextToken (in: pToken=0x18e218 | out: pToken=0x18e218) returned 0x0 [0310.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2a4 | out: ppvObject=0x18e2a4*=0x6c2eec) returned 0x0 [0310.149] WbemLocator:IRpcOptions:Query (in: This=0x6c2eec, pPrx=0x6c2f08, dwProperty=2, pdwValue=0x18e2b0 | out: pdwValue=0x18e2b0) returned 0x80004002 [0310.149] WbemLocator:IUnknown:Release (This=0x6c2eec) returned 0x3 [0310.149] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x2 [0310.149] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0310.149] CoGetContextToken (in: pToken=0x18e758 | out: pToken=0x18e758) returned 0x0 [0310.149] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x18e828*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e824 | out: ppvObject=0x18e824*=0x73c900) returned 0x0 [0310.149] IUnknown:AddRef (This=0x73c900) returned 0x4 [0310.149] IUnknown:Release (This=0x73c900) returned 0x3 [0310.149] IUnknown:Release (This=0x73c900) returned 0x2 [0310.149] WbemLocator:IUnknown:Release (This=0x587e7d0) returned 0x2 [0310.149] SysStringLen (param_1=0x0) returned 0x0 [0310.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb0c | out: puCount=0x18eb0c*=0x2) returned 0x0 [0310.149] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb08*=0x0, pszText=0x0 | out: puBuffLength=0x18eb08*=0xf, pszText=0x0) returned 0x0 [0310.150] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb08*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb08*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0310.150] CoGetContextToken (in: pToken=0x18e958 | out: pToken=0x18e958) returned 0x0 [0310.150] IUnknown:AddRef (This=0x73c900) returned 0x3 [0310.150] IEnumWbemClassObject:Clone (in: This=0x73c900, ppEnum=0x18eb18 | out: ppEnum=0x18eb18*=0x73be10) returned 0x0 [0310.157] IUnknown:QueryInterface (in: This=0x73be10, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9d4 | out: ppvObject=0x18e9d4*=0x73be14) returned 0x0 [0310.158] IClientSecurity:QueryBlanket (in: This=0x73be14, pProxy=0x73be10, pAuthnSvc=0x18ea24, pAuthzSvc=0x18ea20, pServerPrincName=0x18ea18, pAuthnLevel=0x18ea1c, pImpLevel=0x18ea0c, pAuthInfo=0x18ea10, pCapabilites=0x18ea14 | out: pAuthnSvc=0x18ea24*=0xa, pAuthzSvc=0x18ea20*=0x0, pServerPrincName=0x18ea18, pAuthnLevel=0x18ea1c*=0x6, pImpLevel=0x18ea0c*=0x2, pAuthInfo=0x18ea10, pCapabilites=0x18ea14*=0x1) returned 0x0 [0310.158] IUnknown:Release (This=0x73be14) returned 0x1 [0310.158] IUnknown:QueryInterface (in: This=0x73be10, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9c8 | out: ppvObject=0x18e9c8*=0x6c2508) returned 0x0 [0310.158] IUnknown:QueryInterface (in: This=0x73be10, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b4 | out: ppvObject=0x18e9b4*=0x73be14) returned 0x0 [0310.158] IClientSecurity:SetBlanket (This=0x73be14, pProxy=0x73be10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0310.251] IUnknown:Release (This=0x73be14) returned 0x2 [0310.251] WbemLocator:IUnknown:Release (This=0x6c2508) returned 0x1 [0310.251] CoTaskMemFree (pv=0x586eb90) [0310.251] IUnknown:QueryInterface (in: This=0x73be10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5b0 | out: ppvObject=0x18e5b0*=0x6c2508) returned 0x0 [0310.252] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e56c | out: ppvObject=0x18e56c*=0x0) returned 0x80004002 [0310.254] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e38c | out: ppvObject=0x18e38c*=0x0) returned 0x80004002 [0310.255] IUnknown:QueryInterface (in: This=0x73be10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e164 | out: ppvObject=0x18e164*=0x0) returned 0x80004002 [0310.256] WbemLocator:IUnknown:AddRef (This=0x6c2508) returned 0x3 [0310.256] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dec4 | out: ppvObject=0x18dec4*=0x0) returned 0x80004002 [0310.256] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de74 | out: ppvObject=0x18de74*=0x0) returned 0x80004002 [0310.256] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de80 | out: ppvObject=0x18de80*=0x6c2464) returned 0x0 [0310.256] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2464, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de88 | out: pCid=0x18de88*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0310.257] WbemLocator:IUnknown:Release (This=0x6c2464) returned 0x3 [0310.257] CoGetContextToken (in: pToken=0x18dee0 | out: pToken=0x18dee0) returned 0x0 [0310.257] CoGetContextToken (in: pToken=0x18e2e8 | out: pToken=0x18e2e8) returned 0x0 [0310.257] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e374 | out: ppvObject=0x18e374*=0x6c24ec) returned 0x0 [0310.257] WbemLocator:IRpcOptions:Query (in: This=0x6c24ec, pPrx=0x6c2508, dwProperty=2, pdwValue=0x18e380 | out: pdwValue=0x18e380) returned 0x80004002 [0310.257] WbemLocator:IUnknown:Release (This=0x6c24ec) returned 0x3 [0310.257] WbemLocator:IUnknown:Release (This=0x6c2508) returned 0x2 [0310.257] CoGetContextToken (in: pToken=0x18e8c0 | out: pToken=0x18e8c0) returned 0x0 [0310.257] CoGetContextToken (in: pToken=0x18e820 | out: pToken=0x18e820) returned 0x0 [0310.257] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2508, riid=0x18e8f0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8ec | out: ppvObject=0x18e8ec*=0x73be10) returned 0x0 [0310.257] IUnknown:AddRef (This=0x73be10) returned 0x4 [0310.258] IUnknown:Release (This=0x73be10) returned 0x3 [0310.258] IUnknown:Release (This=0x73be10) returned 0x2 [0310.258] IUnknown:Release (This=0x73c900) returned 0x2 [0310.258] SysStringLen (param_1=0x0) returned 0x0 [0310.258] IEnumWbemClassObject:Reset (This=0x73be10) returned 0x0 [0310.259] CoTaskMemAlloc (cb=0x4) returned 0x586b7f0 [0310.259] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b7f0, puReturned=0x2320524 | out: apObjects=0x586b7f0*=0x6f3f18, puReturned=0x2320524*=0x1) returned 0x0 [0313.138] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3f18) returned 0x0 [0313.138] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.138] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.138] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.139] IUnknown:AddRef (This=0x6f3f18) returned 0x3 [0313.139] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.139] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.139] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f3f1c) returned 0x0 [0313.139] IMarshal:GetUnmarshalClass (in: This=0x6f3f1c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.139] IUnknown:Release (This=0x6f3f1c) returned 0x3 [0313.139] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.139] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.139] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.139] IUnknown:Release (This=0x6f3f18) returned 0x2 [0313.140] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.140] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.140] IUnknown:QueryInterface (in: This=0x6f3f18, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3f18) returned 0x0 [0313.140] IUnknown:AddRef (This=0x6f3f18) returned 0x4 [0313.140] IUnknown:Release (This=0x6f3f18) returned 0x3 [0313.140] IUnknown:Release (This=0x6f3f18) returned 0x2 [0313.140] CoTaskMemFree (pv=0x586b7f0) [0313.140] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.140] IUnknown:AddRef (This=0x6f3f18) returned 0x3 [0313.141] IWbemClassObject:Get (in: This=0x6f3f18, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.141] IWbemClassObject:Get (in: This=0x6f3f18, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.141] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0313.141] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0313.142] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.142] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.142] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.142] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.146] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b7f0) returned 0x0 [0313.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b7f0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.146] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b7f0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f4a90) returned 0x0 [0313.146] WbemDefPath:IUnknown:Release (This=0x586b7f0) returned 0x0 [0313.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f4a90) returned 0x0 [0313.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.147] WbemDefPath:IUnknown:AddRef (This=0x6f4a90) returned 0x3 [0313.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897200) returned 0x0 [0313.147] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897200, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.147] WbemDefPath:IUnknown:Release (This=0x5897200) returned 0x3 [0313.147] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.147] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.148] WbemDefPath:IUnknown:Release (This=0x6f4a90) returned 0x2 [0313.148] WbemDefPath:IUnknown:Release (This=0x6f4a90) returned 0x1 [0313.148] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.148] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4a90, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f4a90) returned 0x0 [0313.148] WbemDefPath:IUnknown:AddRef (This=0x6f4a90) returned 0x3 [0313.148] WbemDefPath:IUnknown:Release (This=0x6f4a90) returned 0x2 [0313.148] WbemDefPath:IWbemPath:SetText (This=0x6f4a90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.148] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.148] IWbemClassObject:Get (in: This=0x6f3f18, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2320e14*=0, plFlavor=0x2320e18*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2320e14*=8, plFlavor=0x2320e18*=0) returned 0x0 [0313.149] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0313.149] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0313.149] IWbemClassObject:Get (in: This=0x6f3f18, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2320e14*=8, plFlavor=0x2320e18*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2320e14*=8, plFlavor=0x2320e18*=0) returned 0x0 [0313.149] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0313.149] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0313.154] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0313.154] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x6f3d80, puReturned=0x2320524*=0x1) returned 0x0 [0313.157] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3d80) returned 0x0 [0313.157] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.157] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.157] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.158] IUnknown:AddRef (This=0x6f3d80) returned 0x3 [0313.158] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.158] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.158] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f3d84) returned 0x0 [0313.158] IMarshal:GetUnmarshalClass (in: This=0x6f3d84, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.158] IUnknown:Release (This=0x6f3d84) returned 0x3 [0313.158] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.158] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.158] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.158] IUnknown:Release (This=0x6f3d80) returned 0x2 [0313.158] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.158] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.158] IUnknown:QueryInterface (in: This=0x6f3d80, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3d80) returned 0x0 [0313.159] IUnknown:AddRef (This=0x6f3d80) returned 0x4 [0313.159] IUnknown:Release (This=0x6f3d80) returned 0x3 [0313.159] IUnknown:Release (This=0x6f3d80) returned 0x2 [0313.159] CoTaskMemFree (pv=0x586b220) [0313.159] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.159] IUnknown:AddRef (This=0x6f3d80) returned 0x3 [0313.159] IWbemClassObject:Get (in: This=0x6f3d80, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.159] IWbemClassObject:Get (in: This=0x6f3d80, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.159] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0313.159] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0313.160] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.160] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.160] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.160] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.161] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b150) returned 0x0 [0313.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b150, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.161] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b150, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f5510) returned 0x0 [0313.162] WbemDefPath:IUnknown:Release (This=0x586b150) returned 0x0 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f5510) returned 0x0 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.162] WbemDefPath:IUnknown:AddRef (This=0x6f5510) returned 0x3 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58976e0) returned 0x0 [0313.162] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58976e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.162] WbemDefPath:IUnknown:Release (This=0x58976e0) returned 0x3 [0313.162] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.163] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.163] WbemDefPath:IUnknown:Release (This=0x6f5510) returned 0x2 [0313.163] WbemDefPath:IUnknown:Release (This=0x6f5510) returned 0x1 [0313.163] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.163] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5510, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f5510) returned 0x0 [0313.163] WbemDefPath:IUnknown:AddRef (This=0x6f5510) returned 0x3 [0313.163] WbemDefPath:IUnknown:Release (This=0x6f5510) returned 0x2 [0313.163] WbemDefPath:IWbemPath:SetText (This=0x6f5510, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x0 [0313.163] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.164] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.164] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.164] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.164] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.164] IWbemClassObject:Get (in: This=0x6f3d80, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2321698*=0, plFlavor=0x232169c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2321698*=8, plFlavor=0x232169c*=0) returned 0x0 [0313.164] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0313.164] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0313.164] IWbemClassObject:Get (in: This=0x6f3d80, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2321698*=8, plFlavor=0x232169c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2321698*=8, plFlavor=0x232169c*=0) returned 0x0 [0313.165] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0313.165] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0313.165] CoTaskMemAlloc (cb=0x4) returned 0x586b1b0 [0313.165] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1b0, puReturned=0x2320524 | out: apObjects=0x586b1b0*=0x6f40b0, puReturned=0x2320524*=0x1) returned 0x0 [0313.226] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f40b0) returned 0x0 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.227] IUnknown:AddRef (This=0x6f40b0) returned 0x3 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.227] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f40b4) returned 0x0 [0313.227] IMarshal:GetUnmarshalClass (in: This=0x6f40b4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.227] IUnknown:Release (This=0x6f40b4) returned 0x3 [0313.228] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.228] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.228] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.228] IUnknown:Release (This=0x6f40b0) returned 0x2 [0313.228] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.228] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.228] IUnknown:QueryInterface (in: This=0x6f40b0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f40b0) returned 0x0 [0313.228] IUnknown:AddRef (This=0x6f40b0) returned 0x4 [0313.228] IUnknown:Release (This=0x6f40b0) returned 0x3 [0313.228] IUnknown:Release (This=0x6f40b0) returned 0x2 [0313.228] CoTaskMemFree (pv=0x586b1b0) [0313.228] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.228] IUnknown:AddRef (This=0x6f40b0) returned 0x3 [0313.229] IWbemClassObject:Get (in: This=0x6f40b0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.229] IWbemClassObject:Get (in: This=0x6f40b0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.229] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0313.229] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0313.229] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.229] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.229] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.230] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.231] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b150) returned 0x0 [0313.231] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b150, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.231] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b150, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f49b0) returned 0x0 [0313.231] WbemDefPath:IUnknown:Release (This=0x586b150) returned 0x0 [0313.231] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f49b0) returned 0x0 [0313.231] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.231] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.231] WbemDefPath:IUnknown:AddRef (This=0x6f49b0) returned 0x3 [0313.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897530) returned 0x0 [0313.232] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897530, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.232] WbemDefPath:IUnknown:Release (This=0x5897530) returned 0x3 [0313.232] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.232] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.232] WbemDefPath:IUnknown:Release (This=0x6f49b0) returned 0x2 [0313.232] WbemDefPath:IUnknown:Release (This=0x6f49b0) returned 0x1 [0313.232] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.232] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f49b0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f49b0) returned 0x0 [0313.233] WbemDefPath:IUnknown:AddRef (This=0x6f49b0) returned 0x3 [0313.233] WbemDefPath:IUnknown:Release (This=0x6f49b0) returned 0x2 [0313.233] WbemDefPath:IWbemPath:SetText (This=0x6f49b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.233] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.233] IWbemClassObject:Get (in: This=0x6f40b0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2321f2c*=0, plFlavor=0x2321f30*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2321f2c*=8, plFlavor=0x2321f30*=0) returned 0x0 [0313.233] SysStringByteLen (bstr="dwm.exe") returned 0xe [0313.233] SysStringByteLen (bstr="dwm.exe") returned 0xe [0313.234] IWbemClassObject:Get (in: This=0x6f40b0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2321f2c*=8, plFlavor=0x2321f30*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2321f2c*=8, plFlavor=0x2321f30*=0) returned 0x0 [0313.234] SysStringByteLen (bstr="dwm.exe") returned 0xe [0313.234] SysStringByteLen (bstr="dwm.exe") returned 0xe [0313.234] CoTaskMemAlloc (cb=0x4) returned 0x586b200 [0313.234] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b200, puReturned=0x2320524 | out: apObjects=0x586b200*=0x6f3258, puReturned=0x2320524*=0x1) returned 0x0 [0313.235] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3258) returned 0x0 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.236] IUnknown:AddRef (This=0x6f3258) returned 0x3 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f325c) returned 0x0 [0313.236] IMarshal:GetUnmarshalClass (in: This=0x6f325c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.236] IUnknown:Release (This=0x6f325c) returned 0x3 [0313.236] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.236] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.236] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.237] IUnknown:Release (This=0x6f3258) returned 0x2 [0313.237] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.237] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.237] IUnknown:QueryInterface (in: This=0x6f3258, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3258) returned 0x0 [0313.237] IUnknown:AddRef (This=0x6f3258) returned 0x4 [0313.237] IUnknown:Release (This=0x6f3258) returned 0x3 [0313.237] IUnknown:Release (This=0x6f3258) returned 0x2 [0313.237] CoTaskMemFree (pv=0x586b200) [0313.237] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.237] IUnknown:AddRef (This=0x6f3258) returned 0x3 [0313.237] IWbemClassObject:Get (in: This=0x6f3258, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.237] IWbemClassObject:Get (in: This=0x6f3258, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.238] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0313.238] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0313.238] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.238] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.238] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.238] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.239] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0313.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.239] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f4b00) returned 0x0 [0313.240] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f4b00) returned 0x0 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.240] WbemDefPath:IUnknown:AddRef (This=0x6f4b00) returned 0x3 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58979c8) returned 0x0 [0313.240] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58979c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.240] WbemDefPath:IUnknown:Release (This=0x58979c8) returned 0x3 [0313.240] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.240] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.240] WbemDefPath:IUnknown:Release (This=0x6f4b00) returned 0x2 [0313.240] WbemDefPath:IUnknown:Release (This=0x6f4b00) returned 0x1 [0313.241] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.241] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4b00, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f4b00) returned 0x0 [0313.241] WbemDefPath:IUnknown:AddRef (This=0x6f4b00) returned 0x3 [0313.241] WbemDefPath:IUnknown:Release (This=0x6f4b00) returned 0x2 [0313.241] WbemDefPath:IWbemPath:SetText (This=0x6f4b00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.241] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.241] IWbemClassObject:Get (in: This=0x6f3258, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23227a8*=0, plFlavor=0x23227ac*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x23227a8*=8, plFlavor=0x23227ac*=0) returned 0x0 [0313.241] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0313.241] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0313.242] IWbemClassObject:Get (in: This=0x6f3258, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23227a8*=8, plFlavor=0x23227ac*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x23227a8*=8, plFlavor=0x23227ac*=0) returned 0x0 [0313.242] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0313.242] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0313.242] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0313.242] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x6f3588, puReturned=0x2320524*=0x1) returned 0x0 [0313.244] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3588) returned 0x0 [0313.244] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.244] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.244] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.245] IUnknown:AddRef (This=0x6f3588) returned 0x3 [0313.245] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.245] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.245] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f358c) returned 0x0 [0313.245] IMarshal:GetUnmarshalClass (in: This=0x6f358c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.245] IUnknown:Release (This=0x6f358c) returned 0x3 [0313.245] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.245] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.245] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.245] IUnknown:Release (This=0x6f3588) returned 0x2 [0313.246] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.246] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.246] IUnknown:QueryInterface (in: This=0x6f3588, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3588) returned 0x0 [0313.246] IUnknown:AddRef (This=0x6f3588) returned 0x4 [0313.246] IUnknown:Release (This=0x6f3588) returned 0x3 [0313.246] IUnknown:Release (This=0x6f3588) returned 0x2 [0313.246] CoTaskMemFree (pv=0x586b1c0) [0313.246] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.246] IUnknown:AddRef (This=0x6f3588) returned 0x3 [0313.246] IWbemClassObject:Get (in: This=0x6f3588, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.246] IWbemClassObject:Get (in: This=0x6f3588, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.246] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0313.246] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0313.246] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.247] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.247] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.247] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.248] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b160) returned 0x0 [0313.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b160, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.248] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b160, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f4be0) returned 0x0 [0313.248] WbemDefPath:IUnknown:Release (This=0x586b160) returned 0x0 [0313.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f4be0) returned 0x0 [0313.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.249] WbemDefPath:IUnknown:AddRef (This=0x6f4be0) returned 0x3 [0313.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897a58) returned 0x0 [0313.249] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897a58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.249] WbemDefPath:IUnknown:Release (This=0x5897a58) returned 0x3 [0313.249] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.249] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.249] WbemDefPath:IUnknown:Release (This=0x6f4be0) returned 0x2 [0313.249] WbemDefPath:IUnknown:Release (This=0x6f4be0) returned 0x1 [0313.249] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.249] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.249] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f4be0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f4be0) returned 0x0 [0313.249] WbemDefPath:IUnknown:AddRef (This=0x6f4be0) returned 0x3 [0313.250] WbemDefPath:IUnknown:Release (This=0x6f4be0) returned 0x2 [0313.250] WbemDefPath:IWbemPath:SetText (This=0x6f4be0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.250] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.250] IWbemClassObject:Get (in: This=0x6f3588, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2323034*=0, plFlavor=0x2323038*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x2323034*=8, plFlavor=0x2323038*=0) returned 0x0 [0313.250] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0313.250] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0313.250] IWbemClassObject:Get (in: This=0x6f3588, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2323034*=8, plFlavor=0x2323038*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x2323034*=8, plFlavor=0x2323038*=0) returned 0x0 [0313.251] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0313.251] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0313.251] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0313.251] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x6f3720, puReturned=0x2320524*=0x1) returned 0x0 [0313.327] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3720) returned 0x0 [0313.327] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.327] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.327] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.328] IUnknown:AddRef (This=0x6f3720) returned 0x3 [0313.328] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.328] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.328] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f3724) returned 0x0 [0313.328] IMarshal:GetUnmarshalClass (in: This=0x6f3724, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.328] IUnknown:Release (This=0x6f3724) returned 0x3 [0313.328] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.328] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.328] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.328] IUnknown:Release (This=0x6f3720) returned 0x2 [0313.329] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.329] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.329] IUnknown:QueryInterface (in: This=0x6f3720, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3720) returned 0x0 [0313.329] IUnknown:AddRef (This=0x6f3720) returned 0x4 [0313.329] IUnknown:Release (This=0x6f3720) returned 0x3 [0313.329] IUnknown:Release (This=0x6f3720) returned 0x2 [0313.329] CoTaskMemFree (pv=0x586b1c0) [0313.329] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.329] IUnknown:AddRef (This=0x6f3720) returned 0x3 [0313.329] IWbemClassObject:Get (in: This=0x6f3720, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.330] IWbemClassObject:Get (in: This=0x6f3720, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.330] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0313.330] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0313.330] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.330] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.331] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.331] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.333] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b220) returned 0x0 [0313.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b220, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.333] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b220, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f55f0) returned 0x0 [0313.334] WbemDefPath:IUnknown:Release (This=0x586b220) returned 0x0 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f55f0) returned 0x0 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.334] WbemDefPath:IUnknown:AddRef (This=0x6f55f0) returned 0x3 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897c98) returned 0x0 [0313.334] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897c98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.334] WbemDefPath:IUnknown:Release (This=0x5897c98) returned 0x3 [0313.334] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.335] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.335] WbemDefPath:IUnknown:Release (This=0x6f55f0) returned 0x2 [0313.335] WbemDefPath:IUnknown:Release (This=0x6f55f0) returned 0x1 [0313.335] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.335] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f55f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f55f0) returned 0x0 [0313.335] WbemDefPath:IUnknown:AddRef (This=0x6f55f0) returned 0x3 [0313.335] WbemDefPath:IUnknown:Release (This=0x6f55f0) returned 0x2 [0313.335] WbemDefPath:IWbemPath:SetText (This=0x6f55f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x0 [0313.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.335] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.335] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.336] IWbemClassObject:Get (in: This=0x6f3720, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23238d8*=0, plFlavor=0x23238dc*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x23238d8*=8, plFlavor=0x23238dc*=0) returned 0x0 [0313.336] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0313.336] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0313.336] IWbemClassObject:Get (in: This=0x6f3720, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23238d8*=8, plFlavor=0x23238dc*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x23238d8*=8, plFlavor=0x23238dc*=0) returned 0x0 [0313.336] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0313.336] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0313.337] CoTaskMemAlloc (cb=0x4) returned 0x586b110 [0313.337] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b110, puReturned=0x2320524 | out: apObjects=0x586b110*=0x6f33f0, puReturned=0x2320524*=0x1) returned 0x0 [0313.339] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f33f0) returned 0x0 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.340] IUnknown:AddRef (This=0x6f33f0) returned 0x3 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f33f4) returned 0x0 [0313.340] IMarshal:GetUnmarshalClass (in: This=0x6f33f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.340] IUnknown:Release (This=0x6f33f4) returned 0x3 [0313.340] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.340] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.340] IUnknown:Release (This=0x6f33f0) returned 0x2 [0313.340] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.340] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.340] IUnknown:QueryInterface (in: This=0x6f33f0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f33f0) returned 0x0 [0313.341] IUnknown:AddRef (This=0x6f33f0) returned 0x4 [0313.341] IUnknown:Release (This=0x6f33f0) returned 0x3 [0313.341] IUnknown:Release (This=0x6f33f0) returned 0x2 [0313.341] CoTaskMemFree (pv=0x586b110) [0313.341] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.341] IUnknown:AddRef (This=0x6f33f0) returned 0x3 [0313.341] IWbemClassObject:Get (in: This=0x6f33f0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.341] IWbemClassObject:Get (in: This=0x6f33f0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.341] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0313.341] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0313.341] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.341] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.341] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.341] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.342] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b180) returned 0x0 [0313.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b180, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.342] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b180, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f5660) returned 0x0 [0313.342] WbemDefPath:IUnknown:Release (This=0x586b180) returned 0x0 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f5660) returned 0x0 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.343] WbemDefPath:IUnknown:AddRef (This=0x6f5660) returned 0x3 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897b60) returned 0x0 [0313.343] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897b60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.343] WbemDefPath:IUnknown:Release (This=0x5897b60) returned 0x3 [0313.343] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.343] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.344] WbemDefPath:IUnknown:Release (This=0x6f5660) returned 0x2 [0313.344] WbemDefPath:IUnknown:Release (This=0x6f5660) returned 0x1 [0313.344] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.344] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5660, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f5660) returned 0x0 [0313.344] WbemDefPath:IUnknown:AddRef (This=0x6f5660) returned 0x3 [0313.344] WbemDefPath:IUnknown:Release (This=0x6f5660) returned 0x2 [0313.344] WbemDefPath:IWbemPath:SetText (This=0x6f5660, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.344] IWbemClassObject:Get (in: This=0x6f33f0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232416c*=0, plFlavor=0x2324170*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x232416c*=8, plFlavor=0x2324170*=0) returned 0x0 [0313.344] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0313.345] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0313.345] IWbemClassObject:Get (in: This=0x6f33f0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232416c*=8, plFlavor=0x2324170*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x232416c*=8, plFlavor=0x2324170*=0) returned 0x0 [0313.345] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0313.345] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0313.345] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0313.345] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x6f3be8, puReturned=0x2320524*=0x1) returned 0x0 [0313.347] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3be8) returned 0x0 [0313.347] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.348] IUnknown:AddRef (This=0x6f3be8) returned 0x3 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f3bec) returned 0x0 [0313.348] IMarshal:GetUnmarshalClass (in: This=0x6f3bec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.348] IUnknown:Release (This=0x6f3bec) returned 0x3 [0313.348] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.348] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.348] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.348] IUnknown:Release (This=0x6f3be8) returned 0x2 [0313.349] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.349] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.349] IUnknown:QueryInterface (in: This=0x6f3be8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3be8) returned 0x0 [0313.349] IUnknown:AddRef (This=0x6f3be8) returned 0x4 [0313.349] IUnknown:Release (This=0x6f3be8) returned 0x3 [0313.349] IUnknown:Release (This=0x6f3be8) returned 0x2 [0313.349] CoTaskMemFree (pv=0x586b220) [0313.349] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.349] IUnknown:AddRef (This=0x6f3be8) returned 0x3 [0313.349] IWbemClassObject:Get (in: This=0x6f3be8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.349] IWbemClassObject:Get (in: This=0x6f3be8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.349] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0313.350] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0313.350] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.350] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.350] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.351] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b170) returned 0x0 [0313.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b170, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.351] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b170, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f56d0) returned 0x0 [0313.351] WbemDefPath:IUnknown:Release (This=0x586b170) returned 0x0 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f56d0) returned 0x0 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.352] WbemDefPath:IUnknown:AddRef (This=0x6f56d0) returned 0x3 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897e18) returned 0x0 [0313.352] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897e18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.352] WbemDefPath:IUnknown:Release (This=0x5897e18) returned 0x3 [0313.352] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.352] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.353] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.353] WbemDefPath:IUnknown:Release (This=0x6f56d0) returned 0x2 [0313.353] WbemDefPath:IUnknown:Release (This=0x6f56d0) returned 0x1 [0313.353] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.353] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.353] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f56d0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f56d0) returned 0x0 [0313.353] WbemDefPath:IUnknown:AddRef (This=0x6f56d0) returned 0x3 [0313.353] WbemDefPath:IUnknown:Release (This=0x6f56d0) returned 0x2 [0313.353] WbemDefPath:IWbemPath:SetText (This=0x6f56d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.353] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.354] IWbemClassObject:Get (in: This=0x6f3be8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324a00*=0, plFlavor=0x2324a04*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x2324a00*=8, plFlavor=0x2324a04*=0) returned 0x0 [0313.354] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0313.354] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0313.354] IWbemClassObject:Get (in: This=0x6f3be8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2324a00*=8, plFlavor=0x2324a04*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x2324a00*=8, plFlavor=0x2324a04*=0) returned 0x0 [0313.354] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0313.354] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0313.354] CoTaskMemAlloc (cb=0x4) returned 0x586b290 [0313.354] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b290, puReturned=0x2320524 | out: apObjects=0x586b290*=0x6f2f28, puReturned=0x2320524*=0x1) returned 0x0 [0313.430] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2f28) returned 0x0 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.431] IUnknown:AddRef (This=0x6f2f28) returned 0x3 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f2f2c) returned 0x0 [0313.431] IMarshal:GetUnmarshalClass (in: This=0x6f2f2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.431] IUnknown:Release (This=0x6f2f2c) returned 0x3 [0313.431] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.431] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.431] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.431] IUnknown:Release (This=0x6f2f28) returned 0x2 [0313.432] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.432] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.432] IUnknown:QueryInterface (in: This=0x6f2f28, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2f28) returned 0x0 [0313.432] IUnknown:AddRef (This=0x6f2f28) returned 0x4 [0313.432] IUnknown:Release (This=0x6f2f28) returned 0x3 [0313.432] IUnknown:Release (This=0x6f2f28) returned 0x2 [0313.432] CoTaskMemFree (pv=0x586b290) [0313.432] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.432] IUnknown:AddRef (This=0x6f2f28) returned 0x3 [0313.432] IWbemClassObject:Get (in: This=0x6f2f28, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.432] IWbemClassObject:Get (in: This=0x6f2f28, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.432] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0313.433] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0313.433] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.433] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.433] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.433] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.434] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1b0) returned 0x0 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1b0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.435] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1b0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6f5740) returned 0x0 [0313.435] WbemDefPath:IUnknown:Release (This=0x586b1b0) returned 0x0 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6f5740) returned 0x0 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.435] WbemDefPath:IUnknown:AddRef (This=0x6f5740) returned 0x3 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5897fb0) returned 0x0 [0313.435] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897fb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.436] WbemDefPath:IUnknown:Release (This=0x5897fb0) returned 0x3 [0313.436] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.436] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.436] WbemDefPath:IUnknown:Release (This=0x6f5740) returned 0x2 [0313.436] WbemDefPath:IUnknown:Release (This=0x6f5740) returned 0x1 [0313.436] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.436] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x6f5740, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6f5740) returned 0x0 [0313.436] WbemDefPath:IUnknown:AddRef (This=0x6f5740) returned 0x3 [0313.436] WbemDefPath:IUnknown:Release (This=0x6f5740) returned 0x2 [0313.436] WbemDefPath:IWbemPath:SetText (This=0x6f5740, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x0 [0313.436] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.436] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.436] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.437] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.437] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.437] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.437] IWbemClassObject:Get (in: This=0x6f2f28, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23252bc*=0, plFlavor=0x23252c0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x23252bc*=8, plFlavor=0x23252c0*=0) returned 0x0 [0313.437] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0313.437] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0313.437] IWbemClassObject:Get (in: This=0x6f2f28, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23252bc*=8, plFlavor=0x23252c0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x23252bc*=8, plFlavor=0x23252c0*=0) returned 0x0 [0313.437] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0313.437] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0313.438] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0313.438] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x6f3a50, puReturned=0x2320524*=0x1) returned 0x0 [0313.439] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f3a50) returned 0x0 [0313.439] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.439] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.439] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.440] IUnknown:AddRef (This=0x6f3a50) returned 0x3 [0313.440] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.440] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.440] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f3a54) returned 0x0 [0313.440] IMarshal:GetUnmarshalClass (in: This=0x6f3a54, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.440] IUnknown:Release (This=0x6f3a54) returned 0x3 [0313.440] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.440] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.440] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.441] IUnknown:Release (This=0x6f3a50) returned 0x2 [0313.441] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.441] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.441] IUnknown:QueryInterface (in: This=0x6f3a50, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f3a50) returned 0x0 [0313.441] IUnknown:AddRef (This=0x6f3a50) returned 0x4 [0313.441] IUnknown:Release (This=0x6f3a50) returned 0x3 [0313.441] IUnknown:Release (This=0x6f3a50) returned 0x2 [0313.441] CoTaskMemFree (pv=0x586b220) [0313.441] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.441] IUnknown:AddRef (This=0x6f3a50) returned 0x3 [0313.441] IWbemClassObject:Get (in: This=0x6f3a50, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.441] IWbemClassObject:Get (in: This=0x6f3a50, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.442] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0313.442] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0313.442] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.442] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.442] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.442] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.443] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0313.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.443] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4310) returned 0x0 [0313.444] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4310) returned 0x0 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.444] WbemDefPath:IUnknown:AddRef (This=0x6d4310) returned 0x3 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58980b8) returned 0x0 [0313.444] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58980b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.444] WbemDefPath:IUnknown:Release (This=0x58980b8) returned 0x3 [0313.444] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.445] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.445] WbemDefPath:IUnknown:Release (This=0x6d4310) returned 0x2 [0313.445] WbemDefPath:IUnknown:Release (This=0x6d4310) returned 0x1 [0313.445] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.445] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4310, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4310) returned 0x0 [0313.445] WbemDefPath:IUnknown:AddRef (This=0x6d4310) returned 0x3 [0313.445] WbemDefPath:IUnknown:Release (This=0x6d4310) returned 0x2 [0313.445] WbemDefPath:IWbemPath:SetText (This=0x6d4310, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x0 [0313.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.445] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.446] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.446] IWbemClassObject:Get (in: This=0x6f3a50, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325b50*=0, plFlavor=0x2325b54*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x2325b50*=8, plFlavor=0x2325b54*=0) returned 0x0 [0313.446] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0313.446] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0313.446] IWbemClassObject:Get (in: This=0x6f3a50, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2325b50*=8, plFlavor=0x2325b54*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x2325b50*=8, plFlavor=0x2325b54*=0) returned 0x0 [0313.446] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0313.446] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0313.447] CoTaskMemAlloc (cb=0x4) returned 0x586b1f0 [0313.447] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1f0, puReturned=0x2320524 | out: apObjects=0x586b1f0*=0x6f38b8, puReturned=0x2320524*=0x1) returned 0x0 [0313.449] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f38b8) returned 0x0 [0313.449] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0313.449] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0313.449] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0313.450] IUnknown:AddRef (This=0x6f38b8) returned 0x3 [0313.450] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0313.450] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0313.450] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f38bc) returned 0x0 [0313.450] IMarshal:GetUnmarshalClass (in: This=0x6f38bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0313.450] IUnknown:Release (This=0x6f38bc) returned 0x3 [0313.450] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0313.450] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0313.450] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0313.450] IUnknown:Release (This=0x6f38b8) returned 0x2 [0313.450] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0313.450] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0313.450] IUnknown:QueryInterface (in: This=0x6f38b8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f38b8) returned 0x0 [0313.451] IUnknown:AddRef (This=0x6f38b8) returned 0x4 [0313.451] IUnknown:Release (This=0x6f38b8) returned 0x3 [0313.451] IUnknown:Release (This=0x6f38b8) returned 0x2 [0313.451] CoTaskMemFree (pv=0x586b1f0) [0313.451] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0313.451] IUnknown:AddRef (This=0x6f38b8) returned 0x3 [0313.451] IWbemClassObject:Get (in: This=0x6f38b8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0313.451] IWbemClassObject:Get (in: This=0x6f38b8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0313.451] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x5c [0313.451] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x5c [0313.451] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0313.452] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0313.452] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0313.452] IUnknown:Release (This=0x692bc4) returned 0x1 [0313.453] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1c0) returned 0x0 [0313.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0313.453] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4380) returned 0x0 [0313.453] WbemDefPath:IUnknown:Release (This=0x586b1c0) returned 0x0 [0313.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4380) returned 0x0 [0313.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0313.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0313.454] WbemDefPath:IUnknown:AddRef (This=0x6d4380) returned 0x3 [0313.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0313.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0313.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5898358) returned 0x0 [0313.454] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5898358, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0313.454] WbemDefPath:IUnknown:Release (This=0x5898358) returned 0x3 [0313.454] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0313.454] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0313.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0313.454] WbemDefPath:IUnknown:Release (This=0x6d4380) returned 0x2 [0313.454] WbemDefPath:IUnknown:Release (This=0x6d4380) returned 0x1 [0313.454] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0313.454] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0313.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4380, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4380) returned 0x0 [0313.455] WbemDefPath:IUnknown:AddRef (This=0x6d4380) returned 0x3 [0313.455] WbemDefPath:IUnknown:Release (This=0x6d4380) returned 0x2 [0313.455] WbemDefPath:IWbemPath:SetText (This=0x6d4380, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"992\"") returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0313.455] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0313.455] IWbemClassObject:Get (in: This=0x6f38b8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23263dc*=0, plFlavor=0x23263e0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23263dc*=8, plFlavor=0x23263e0*=0) returned 0x0 [0313.455] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0313.455] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0313.456] IWbemClassObject:Get (in: This=0x6f38b8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23263dc*=8, plFlavor=0x23263e0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23263dc*=8, plFlavor=0x23263e0*=0) returned 0x0 [0313.456] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0313.456] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0313.456] CoTaskMemAlloc (cb=0x4) returned 0x586b240 [0313.456] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b240, puReturned=0x2320524 | out: apObjects=0x586b240*=0x6f2268, puReturned=0x2320524*=0x1) returned 0x0 [0317.062] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2268) returned 0x0 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.063] IUnknown:AddRef (This=0x6f2268) returned 0x3 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.063] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f226c) returned 0x0 [0317.063] IMarshal:GetUnmarshalClass (in: This=0x6f226c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.063] IUnknown:Release (This=0x6f226c) returned 0x3 [0317.063] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.064] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.064] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.064] IUnknown:Release (This=0x6f2268) returned 0x2 [0317.064] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.064] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.064] IUnknown:QueryInterface (in: This=0x6f2268, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2268) returned 0x0 [0317.064] IUnknown:AddRef (This=0x6f2268) returned 0x4 [0317.064] IUnknown:Release (This=0x6f2268) returned 0x3 [0317.064] IUnknown:Release (This=0x6f2268) returned 0x2 [0317.064] CoTaskMemFree (pv=0x586b240) [0317.064] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.064] IUnknown:AddRef (This=0x6f2268) returned 0x3 [0317.065] IWbemClassObject:Get (in: This=0x6f2268, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.065] IWbemClassObject:Get (in: This=0x6f2268, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.066] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0317.066] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0317.066] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.067] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.067] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.067] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.070] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b170) returned 0x0 [0317.071] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b170, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.071] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b170, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d43f0) returned 0x0 [0317.072] WbemDefPath:IUnknown:Release (This=0x586b170) returned 0x0 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d43f0) returned 0x0 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.072] WbemDefPath:IUnknown:AddRef (This=0x6d43f0) returned 0x3 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.072] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5898388) returned 0x0 [0317.073] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5898388, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.073] WbemDefPath:IUnknown:Release (This=0x5898388) returned 0x3 [0317.073] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.074] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.074] WbemDefPath:IUnknown:Release (This=0x6d43f0) returned 0x2 [0317.074] WbemDefPath:IUnknown:Release (This=0x6d43f0) returned 0x1 [0317.074] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.074] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d43f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d43f0) returned 0x0 [0317.074] WbemDefPath:IUnknown:AddRef (This=0x6d43f0) returned 0x3 [0317.074] WbemDefPath:IUnknown:Release (This=0x6d43f0) returned 0x2 [0317.074] WbemDefPath:IWbemPath:SetText (This=0x6d43f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x0 [0317.074] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.075] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.075] IWbemClassObject:Get (in: This=0x6f2268, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326c98*=0, plFlavor=0x2326c9c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2326c98*=8, plFlavor=0x2326c9c*=0) returned 0x0 [0317.075] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0317.075] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0317.075] IWbemClassObject:Get (in: This=0x6f2268, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2326c98*=8, plFlavor=0x2326c9c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2326c98*=8, plFlavor=0x2326c9c*=0) returned 0x0 [0317.076] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0317.076] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0317.076] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0317.076] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x6f2598, puReturned=0x2320524*=0x1) returned 0x0 [0317.081] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2598) returned 0x0 [0317.081] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.081] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.081] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.082] IUnknown:AddRef (This=0x6f2598) returned 0x3 [0317.082] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.082] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.082] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f259c) returned 0x0 [0317.082] IMarshal:GetUnmarshalClass (in: This=0x6f259c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.082] IUnknown:Release (This=0x6f259c) returned 0x3 [0317.082] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.082] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.082] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.082] IUnknown:Release (This=0x6f2598) returned 0x2 [0317.082] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.083] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.083] IUnknown:QueryInterface (in: This=0x6f2598, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2598) returned 0x0 [0317.083] IUnknown:AddRef (This=0x6f2598) returned 0x4 [0317.083] IUnknown:Release (This=0x6f2598) returned 0x3 [0317.083] IUnknown:Release (This=0x6f2598) returned 0x2 [0317.083] CoTaskMemFree (pv=0x586b220) [0317.083] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.083] IUnknown:AddRef (This=0x6f2598) returned 0x3 [0317.083] IWbemClassObject:Get (in: This=0x6f2598, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.083] IWbemClassObject:Get (in: This=0x6f2598, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0317.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0317.083] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.084] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.084] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.084] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.085] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b240) returned 0x0 [0317.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b240, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.085] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b240, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d42a0) returned 0x0 [0317.085] WbemDefPath:IUnknown:Release (This=0x586b240) returned 0x0 [0317.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d42a0) returned 0x0 [0317.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.086] WbemDefPath:IUnknown:AddRef (This=0x6d42a0) returned 0x3 [0317.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5898478) returned 0x0 [0317.086] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5898478, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.086] WbemDefPath:IUnknown:Release (This=0x5898478) returned 0x3 [0317.086] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.086] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.086] WbemDefPath:IUnknown:Release (This=0x6d42a0) returned 0x2 [0317.086] WbemDefPath:IUnknown:Release (This=0x6d42a0) returned 0x1 [0317.086] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.086] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d42a0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d42a0) returned 0x0 [0317.087] WbemDefPath:IUnknown:AddRef (This=0x6d42a0) returned 0x3 [0317.087] WbemDefPath:IUnknown:Release (This=0x6d42a0) returned 0x2 [0317.087] WbemDefPath:IWbemPath:SetText (This=0x6d42a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.087] IWbemClassObject:Get (in: This=0x6f2598, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232752c*=0, plFlavor=0x2327530*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x232752c*=8, plFlavor=0x2327530*=0) returned 0x0 [0317.087] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0317.087] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0317.087] IWbemClassObject:Get (in: This=0x6f2598, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232752c*=8, plFlavor=0x2327530*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x232752c*=8, plFlavor=0x2327530*=0) returned 0x0 [0317.088] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0317.088] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0317.088] CoTaskMemAlloc (cb=0x4) returned 0x586b1f0 [0317.088] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1f0, puReturned=0x2320524 | out: apObjects=0x586b1f0*=0x6f2730, puReturned=0x2320524*=0x1) returned 0x0 [0317.170] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2730) returned 0x0 [0317.170] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.170] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.171] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.171] IUnknown:AddRef (This=0x6f2730) returned 0x3 [0317.171] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.171] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.171] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f2734) returned 0x0 [0317.171] IMarshal:GetUnmarshalClass (in: This=0x6f2734, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.171] IUnknown:Release (This=0x6f2734) returned 0x3 [0317.171] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.171] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.171] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.172] IUnknown:Release (This=0x6f2730) returned 0x2 [0317.172] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.172] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.172] IUnknown:QueryInterface (in: This=0x6f2730, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2730) returned 0x0 [0317.172] IUnknown:AddRef (This=0x6f2730) returned 0x4 [0317.172] IUnknown:Release (This=0x6f2730) returned 0x3 [0317.172] IUnknown:Release (This=0x6f2730) returned 0x2 [0317.172] CoTaskMemFree (pv=0x586b1f0) [0317.172] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.172] IUnknown:AddRef (This=0x6f2730) returned 0x3 [0317.172] IWbemClassObject:Get (in: This=0x6f2730, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.172] IWbemClassObject:Get (in: This=0x6f2730, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.173] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0317.173] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0317.173] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.173] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.173] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.173] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.174] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0d0) returned 0x0 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0d0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.175] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0d0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3580) returned 0x0 [0317.175] WbemDefPath:IUnknown:Release (This=0x586b0d0) returned 0x0 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3580) returned 0x0 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.175] WbemDefPath:IUnknown:AddRef (This=0x6d3580) returned 0x3 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5898730) returned 0x0 [0317.176] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5898730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.176] WbemDefPath:IUnknown:Release (This=0x5898730) returned 0x3 [0317.176] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.176] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.176] WbemDefPath:IUnknown:Release (This=0x6d3580) returned 0x2 [0317.176] WbemDefPath:IUnknown:Release (This=0x6d3580) returned 0x1 [0317.176] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.176] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3580, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3580) returned 0x0 [0317.176] WbemDefPath:IUnknown:AddRef (This=0x6d3580) returned 0x3 [0317.176] WbemDefPath:IUnknown:Release (This=0x6d3580) returned 0x2 [0317.177] WbemDefPath:IWbemPath:SetText (This=0x6d3580, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.177] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.177] IWbemClassObject:Get (in: This=0x6f2730, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2327dc8*=0, plFlavor=0x2327dcc*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2327dc8*=8, plFlavor=0x2327dcc*=0) returned 0x0 [0317.177] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0317.177] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0317.177] IWbemClassObject:Get (in: This=0x6f2730, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2327dc8*=8, plFlavor=0x2327dcc*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2327dc8*=8, plFlavor=0x2327dcc*=0) returned 0x0 [0317.178] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0317.178] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0317.178] CoTaskMemAlloc (cb=0x4) returned 0x586b180 [0317.178] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b180, puReturned=0x2320524 | out: apObjects=0x586b180*=0x6f2bf8, puReturned=0x2320524*=0x1) returned 0x0 [0317.180] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2bf8) returned 0x0 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.181] IUnknown:AddRef (This=0x6f2bf8) returned 0x3 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.181] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f2bfc) returned 0x0 [0317.181] IMarshal:GetUnmarshalClass (in: This=0x6f2bfc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.181] IUnknown:Release (This=0x6f2bfc) returned 0x3 [0317.181] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.182] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.182] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.182] IUnknown:Release (This=0x6f2bf8) returned 0x2 [0317.182] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.182] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.182] IUnknown:QueryInterface (in: This=0x6f2bf8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2bf8) returned 0x0 [0317.183] IUnknown:AddRef (This=0x6f2bf8) returned 0x4 [0317.183] IUnknown:Release (This=0x6f2bf8) returned 0x3 [0317.183] IUnknown:Release (This=0x6f2bf8) returned 0x2 [0317.183] CoTaskMemFree (pv=0x586b180) [0317.183] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.183] IUnknown:AddRef (This=0x6f2bf8) returned 0x3 [0317.183] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.183] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0317.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0317.184] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.185] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.185] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.185] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.186] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b110) returned 0x0 [0317.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b110, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.186] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b110, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3660) returned 0x0 [0317.186] WbemDefPath:IUnknown:Release (This=0x586b110) returned 0x0 [0317.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3660) returned 0x0 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.187] WbemDefPath:IUnknown:AddRef (This=0x6d3660) returned 0x3 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5896a80) returned 0x0 [0317.187] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5896a80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.187] WbemDefPath:IUnknown:Release (This=0x5896a80) returned 0x3 [0317.187] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.187] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.187] WbemDefPath:IUnknown:Release (This=0x6d3660) returned 0x2 [0317.187] WbemDefPath:IUnknown:Release (This=0x6d3660) returned 0x1 [0317.188] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.188] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3660, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3660) returned 0x0 [0317.188] WbemDefPath:IUnknown:AddRef (This=0x6d3660) returned 0x3 [0317.188] WbemDefPath:IUnknown:Release (This=0x6d3660) returned 0x2 [0317.188] WbemDefPath:IWbemPath:SetText (This=0x6d3660, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.188] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232867c*=0, plFlavor=0x2328680*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x232867c*=8, plFlavor=0x2328680*=0) returned 0x0 [0317.189] SysStringByteLen (bstr="speak.exe") returned 0x12 [0317.189] SysStringByteLen (bstr="speak.exe") returned 0x12 [0317.189] IWbemClassObject:Get (in: This=0x6f2bf8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232867c*=8, plFlavor=0x2328680*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x232867c*=8, plFlavor=0x2328680*=0) returned 0x0 [0317.189] SysStringByteLen (bstr="speak.exe") returned 0x12 [0317.189] SysStringByteLen (bstr="speak.exe") returned 0x12 [0317.189] CoTaskMemAlloc (cb=0x4) returned 0x586b0c0 [0317.189] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b0c0, puReturned=0x2320524 | out: apObjects=0x586b0c0*=0x6f2d90, puReturned=0x2320524*=0x1) returned 0x0 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6f2d90) returned 0x0 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.191] IUnknown:AddRef (This=0x6f2d90) returned 0x3 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.191] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6f2d94) returned 0x0 [0317.192] IMarshal:GetUnmarshalClass (in: This=0x6f2d94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.192] IUnknown:Release (This=0x6f2d94) returned 0x3 [0317.192] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.192] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.192] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.192] IUnknown:Release (This=0x6f2d90) returned 0x2 [0317.192] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.192] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.192] IUnknown:QueryInterface (in: This=0x6f2d90, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6f2d90) returned 0x0 [0317.192] IUnknown:AddRef (This=0x6f2d90) returned 0x4 [0317.192] IUnknown:Release (This=0x6f2d90) returned 0x3 [0317.192] IUnknown:Release (This=0x6f2d90) returned 0x2 [0317.193] CoTaskMemFree (pv=0x586b0c0) [0317.193] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.193] IUnknown:AddRef (This=0x6f2d90) returned 0x3 [0317.193] IWbemClassObject:Get (in: This=0x6f2d90, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.193] IWbemClassObject:Get (in: This=0x6f2d90, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.193] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0317.193] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0317.193] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.194] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.194] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.194] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.195] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b140) returned 0x0 [0317.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b140, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.195] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b140, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3ac0) returned 0x0 [0317.195] WbemDefPath:IUnknown:Release (This=0x586b140) returned 0x0 [0317.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3ac0) returned 0x0 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.196] WbemDefPath:IUnknown:AddRef (This=0x6d3ac0) returned 0x3 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x5896a38) returned 0x0 [0317.196] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5896a38, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.196] WbemDefPath:IUnknown:Release (This=0x5896a38) returned 0x3 [0317.196] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.196] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.197] WbemDefPath:IUnknown:Release (This=0x6d3ac0) returned 0x2 [0317.197] WbemDefPath:IUnknown:Release (This=0x6d3ac0) returned 0x1 [0317.197] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.197] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ac0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3ac0) returned 0x0 [0317.197] WbemDefPath:IUnknown:AddRef (This=0x6d3ac0) returned 0x3 [0317.197] WbemDefPath:IUnknown:Release (This=0x6d3ac0) returned 0x2 [0317.197] WbemDefPath:IWbemPath:SetText (This=0x6d3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.197] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.198] IWbemClassObject:Get (in: This=0x6f2d90, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2328f00*=0, plFlavor=0x2328f04*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x2328f00*=8, plFlavor=0x2328f04*=0) returned 0x0 [0317.261] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0317.261] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0317.261] IWbemClassObject:Get (in: This=0x6f2d90, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2328f00*=8, plFlavor=0x2328f04*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x2328f00*=8, plFlavor=0x2328f04*=0) returned 0x0 [0317.261] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0317.261] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0317.261] CoTaskMemAlloc (cb=0x4) returned 0x586b110 [0317.262] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b110, puReturned=0x2320524 | out: apObjects=0x586b110*=0x58a6ff0, puReturned=0x2320524*=0x1) returned 0x0 [0317.263] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6ff0) returned 0x0 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.264] IUnknown:AddRef (This=0x58a6ff0) returned 0x3 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.264] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6ff4) returned 0x0 [0317.264] IMarshal:GetUnmarshalClass (in: This=0x58a6ff4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.264] IUnknown:Release (This=0x58a6ff4) returned 0x3 [0317.264] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.265] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.265] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.265] IUnknown:Release (This=0x58a6ff0) returned 0x2 [0317.265] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.265] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.265] IUnknown:QueryInterface (in: This=0x58a6ff0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6ff0) returned 0x0 [0317.265] IUnknown:AddRef (This=0x58a6ff0) returned 0x4 [0317.265] IUnknown:Release (This=0x58a6ff0) returned 0x3 [0317.265] IUnknown:Release (This=0x58a6ff0) returned 0x2 [0317.265] CoTaskMemFree (pv=0x586b110) [0317.265] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.265] IUnknown:AddRef (This=0x58a6ff0) returned 0x3 [0317.265] IWbemClassObject:Get (in: This=0x58a6ff0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.266] IWbemClassObject:Get (in: This=0x58a6ff0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.267] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0317.267] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0317.267] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.267] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.267] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.267] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.268] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b180) returned 0x0 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b180, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.269] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b180, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3820) returned 0x0 [0317.269] WbemDefPath:IUnknown:Release (This=0x586b180) returned 0x0 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3820) returned 0x0 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.269] WbemDefPath:IUnknown:AddRef (This=0x6d3820) returned 0x3 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a48c0) returned 0x0 [0317.270] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a48c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.270] WbemDefPath:IUnknown:Release (This=0x58a48c0) returned 0x3 [0317.270] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.270] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.270] WbemDefPath:IUnknown:Release (This=0x6d3820) returned 0x2 [0317.270] WbemDefPath:IUnknown:Release (This=0x6d3820) returned 0x1 [0317.270] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.270] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3820, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3820) returned 0x0 [0317.270] WbemDefPath:IUnknown:AddRef (This=0x6d3820) returned 0x3 [0317.270] WbemDefPath:IUnknown:Release (This=0x6d3820) returned 0x2 [0317.271] WbemDefPath:IWbemPath:SetText (This=0x6d3820, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.271] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.271] IWbemClassObject:Get (in: This=0x58a6ff0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23297dc*=0, plFlavor=0x23297e0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x23297dc*=8, plFlavor=0x23297e0*=0) returned 0x0 [0317.271] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0317.271] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0317.271] IWbemClassObject:Get (in: This=0x58a6ff0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23297dc*=8, plFlavor=0x23297e0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x23297dc*=8, plFlavor=0x23297e0*=0) returned 0x0 [0317.272] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0317.272] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0317.272] CoTaskMemAlloc (cb=0x4) returned 0x586b180 [0317.272] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b180, puReturned=0x2320524 | out: apObjects=0x586b180*=0x58a5808, puReturned=0x2320524*=0x1) returned 0x0 [0317.273] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5808) returned 0x0 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.274] IUnknown:AddRef (This=0x58a5808) returned 0x3 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a580c) returned 0x0 [0317.274] IMarshal:GetUnmarshalClass (in: This=0x58a580c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.274] IUnknown:Release (This=0x58a580c) returned 0x3 [0317.274] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.274] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.274] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.275] IUnknown:Release (This=0x58a5808) returned 0x2 [0317.275] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.275] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.275] IUnknown:QueryInterface (in: This=0x58a5808, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5808) returned 0x0 [0317.275] IUnknown:AddRef (This=0x58a5808) returned 0x4 [0317.275] IUnknown:Release (This=0x58a5808) returned 0x3 [0317.275] IUnknown:Release (This=0x58a5808) returned 0x2 [0317.275] CoTaskMemFree (pv=0x586b180) [0317.275] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.275] IUnknown:AddRef (This=0x58a5808) returned 0x3 [0317.275] IWbemClassObject:Get (in: This=0x58a5808, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.275] IWbemClassObject:Get (in: This=0x58a5808, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.276] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0317.276] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0317.276] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.277] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.277] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.277] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.278] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b200) returned 0x0 [0317.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.278] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b200, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3eb0) returned 0x0 [0317.278] WbemDefPath:IUnknown:Release (This=0x586b200) returned 0x0 [0317.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3eb0) returned 0x0 [0317.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.279] WbemDefPath:IUnknown:AddRef (This=0x6d3eb0) returned 0x3 [0317.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a46f8) returned 0x0 [0317.279] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a46f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.279] WbemDefPath:IUnknown:Release (This=0x58a46f8) returned 0x3 [0317.279] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.280] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.280] WbemDefPath:IUnknown:Release (This=0x6d3eb0) returned 0x2 [0317.280] WbemDefPath:IUnknown:Release (This=0x6d3eb0) returned 0x1 [0317.280] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.280] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3eb0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3eb0) returned 0x0 [0317.280] WbemDefPath:IUnknown:AddRef (This=0x6d3eb0) returned 0x3 [0317.280] WbemDefPath:IUnknown:Release (This=0x6d3eb0) returned 0x2 [0317.280] WbemDefPath:IWbemPath:SetText (This=0x6d3eb0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x0 [0317.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.280] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.281] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.281] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.281] IWbemClassObject:Get (in: This=0x58a5808, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232a098*=0, plFlavor=0x232a09c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x232a098*=8, plFlavor=0x232a09c*=0) returned 0x0 [0317.281] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0317.281] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0317.281] IWbemClassObject:Get (in: This=0x58a5808, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232a098*=8, plFlavor=0x232a09c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x232a098*=8, plFlavor=0x232a09c*=0) returned 0x0 [0317.281] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0317.281] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0317.282] CoTaskMemAlloc (cb=0x4) returned 0x586b1f0 [0317.282] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1f0, puReturned=0x2320524 | out: apObjects=0x586b1f0*=0x58a5670, puReturned=0x2320524*=0x1) returned 0x0 [0317.285] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5670) returned 0x0 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.286] IUnknown:AddRef (This=0x58a5670) returned 0x3 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.286] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a5674) returned 0x0 [0317.286] IMarshal:GetUnmarshalClass (in: This=0x58a5674, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.286] IUnknown:Release (This=0x58a5674) returned 0x3 [0317.286] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.287] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.287] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.287] IUnknown:Release (This=0x58a5670) returned 0x2 [0317.287] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.287] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.287] IUnknown:QueryInterface (in: This=0x58a5670, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5670) returned 0x0 [0317.287] IUnknown:AddRef (This=0x58a5670) returned 0x4 [0317.287] IUnknown:Release (This=0x58a5670) returned 0x3 [0317.287] IUnknown:Release (This=0x58a5670) returned 0x2 [0317.287] CoTaskMemFree (pv=0x586b1f0) [0317.287] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.287] IUnknown:AddRef (This=0x58a5670) returned 0x3 [0317.287] IWbemClassObject:Get (in: This=0x58a5670, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.288] IWbemClassObject:Get (in: This=0x58a5670, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.288] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0317.288] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0317.288] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.288] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.288] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.288] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.290] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.290] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3f20) returned 0x0 [0317.290] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3f20) returned 0x0 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.290] WbemDefPath:IUnknown:AddRef (This=0x6d3f20) returned 0x3 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4a10) returned 0x0 [0317.291] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4a10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.291] WbemDefPath:IUnknown:Release (This=0x58a4a10) returned 0x3 [0317.291] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.291] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.291] WbemDefPath:IUnknown:Release (This=0x6d3f20) returned 0x2 [0317.291] WbemDefPath:IUnknown:Release (This=0x6d3f20) returned 0x1 [0317.291] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.291] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f20, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3f20) returned 0x0 [0317.291] WbemDefPath:IUnknown:AddRef (This=0x6d3f20) returned 0x3 [0317.291] WbemDefPath:IUnknown:Release (This=0x6d3f20) returned 0x2 [0317.291] WbemDefPath:IWbemPath:SetText (This=0x6d3f20, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x0 [0317.291] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.291] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.372] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.372] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.372] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.373] IWbemClassObject:Get (in: This=0x58a5670, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232a92c*=0, plFlavor=0x232a930*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x232a92c*=8, plFlavor=0x232a930*=0) returned 0x0 [0317.373] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0317.373] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0317.373] IWbemClassObject:Get (in: This=0x58a5670, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232a92c*=8, plFlavor=0x232a930*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x232a92c*=8, plFlavor=0x232a930*=0) returned 0x0 [0317.373] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0317.373] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0317.373] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0317.373] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x58a6330, puReturned=0x2320524*=0x1) returned 0x0 [0317.375] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6330) returned 0x0 [0317.375] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.375] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.375] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.375] IUnknown:AddRef (This=0x58a6330) returned 0x3 [0317.376] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.376] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.376] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6334) returned 0x0 [0317.376] IMarshal:GetUnmarshalClass (in: This=0x58a6334, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.376] IUnknown:Release (This=0x58a6334) returned 0x3 [0317.376] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.376] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.376] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.376] IUnknown:Release (This=0x58a6330) returned 0x2 [0317.376] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.376] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.376] IUnknown:QueryInterface (in: This=0x58a6330, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6330) returned 0x0 [0317.376] IUnknown:AddRef (This=0x58a6330) returned 0x4 [0317.377] IUnknown:Release (This=0x58a6330) returned 0x3 [0317.377] IUnknown:Release (This=0x58a6330) returned 0x2 [0317.377] CoTaskMemFree (pv=0x586b1c0) [0317.377] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.377] IUnknown:AddRef (This=0x58a6330) returned 0x3 [0317.377] IWbemClassObject:Get (in: This=0x58a6330, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.377] IWbemClassObject:Get (in: This=0x58a6330, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.377] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0317.377] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0317.377] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.377] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.377] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.377] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.378] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b220) returned 0x0 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b220, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.379] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b220, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3cf0) returned 0x0 [0317.379] WbemDefPath:IUnknown:Release (This=0x586b220) returned 0x0 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3cf0) returned 0x0 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.379] WbemDefPath:IUnknown:AddRef (This=0x6d3cf0) returned 0x3 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4c98) returned 0x0 [0317.379] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4c98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.379] WbemDefPath:IUnknown:Release (This=0x58a4c98) returned 0x3 [0317.380] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.380] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.380] WbemDefPath:IUnknown:Release (This=0x6d3cf0) returned 0x2 [0317.380] WbemDefPath:IUnknown:Release (This=0x6d3cf0) returned 0x1 [0317.380] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.380] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3cf0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3cf0) returned 0x0 [0317.380] WbemDefPath:IUnknown:AddRef (This=0x6d3cf0) returned 0x3 [0317.380] WbemDefPath:IUnknown:Release (This=0x6d3cf0) returned 0x2 [0317.380] WbemDefPath:IWbemPath:SetText (This=0x6d3cf0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.380] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.381] IWbemClassObject:Get (in: This=0x58a6330, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232b1d0*=0, plFlavor=0x232b1d4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x232b1d0*=8, plFlavor=0x232b1d4*=0) returned 0x0 [0317.381] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0317.381] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0317.381] IWbemClassObject:Get (in: This=0x58a6330, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232b1d0*=8, plFlavor=0x232b1d4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x232b1d0*=8, plFlavor=0x232b1d4*=0) returned 0x0 [0317.381] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0317.381] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0317.381] CoTaskMemAlloc (cb=0x4) returned 0x586b0c0 [0317.381] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b0c0, puReturned=0x2320524 | out: apObjects=0x586b0c0*=0x58a59a0, puReturned=0x2320524*=0x1) returned 0x0 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a59a0) returned 0x0 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.384] IUnknown:AddRef (This=0x58a59a0) returned 0x3 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.384] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a59a4) returned 0x0 [0317.385] IMarshal:GetUnmarshalClass (in: This=0x58a59a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.385] IUnknown:Release (This=0x58a59a4) returned 0x3 [0317.385] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.385] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.385] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.386] IUnknown:Release (This=0x58a59a0) returned 0x2 [0317.386] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.386] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.386] IUnknown:QueryInterface (in: This=0x58a59a0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a59a0) returned 0x0 [0317.386] IUnknown:AddRef (This=0x58a59a0) returned 0x4 [0317.386] IUnknown:Release (This=0x58a59a0) returned 0x3 [0317.387] IUnknown:Release (This=0x58a59a0) returned 0x2 [0317.387] CoTaskMemFree (pv=0x586b0c0) [0317.387] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.387] IUnknown:AddRef (This=0x58a59a0) returned 0x3 [0317.387] IWbemClassObject:Get (in: This=0x58a59a0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.387] IWbemClassObject:Get (in: This=0x58a59a0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.387] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0317.387] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0317.388] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.388] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.388] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.388] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.389] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b220) returned 0x0 [0317.389] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b220, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.389] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b220, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d39e0) returned 0x0 [0317.389] WbemDefPath:IUnknown:Release (This=0x586b220) returned 0x0 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d39e0) returned 0x0 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.390] WbemDefPath:IUnknown:AddRef (This=0x6d39e0) returned 0x3 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4e00) returned 0x0 [0317.390] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4e00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.390] WbemDefPath:IUnknown:Release (This=0x58a4e00) returned 0x3 [0317.390] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.391] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.391] WbemDefPath:IUnknown:Release (This=0x6d39e0) returned 0x2 [0317.391] WbemDefPath:IUnknown:Release (This=0x6d39e0) returned 0x1 [0317.391] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.391] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d39e0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d39e0) returned 0x0 [0317.391] WbemDefPath:IUnknown:AddRef (This=0x6d39e0) returned 0x3 [0317.391] WbemDefPath:IUnknown:Release (This=0x6d39e0) returned 0x2 [0317.391] WbemDefPath:IWbemPath:SetText (This=0x6d39e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x0 [0317.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.391] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.391] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.391] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.391] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.392] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.392] IWbemClassObject:Get (in: This=0x58a59a0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232ba8c*=0, plFlavor=0x232ba90*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x232ba8c*=8, plFlavor=0x232ba90*=0) returned 0x0 [0317.392] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0317.392] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0317.392] IWbemClassObject:Get (in: This=0x58a59a0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232ba8c*=8, plFlavor=0x232ba90*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x232ba8c*=8, plFlavor=0x232ba90*=0) returned 0x0 [0317.392] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0317.392] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0317.393] CoTaskMemAlloc (cb=0x4) returned 0x586b290 [0317.393] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b290, puReturned=0x2320524 | out: apObjects=0x586b290*=0x58a5b38, puReturned=0x2320524*=0x1) returned 0x0 [0317.395] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5b38) returned 0x0 [0317.395] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.395] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.395] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.395] IUnknown:AddRef (This=0x58a5b38) returned 0x3 [0317.395] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.396] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.396] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a5b3c) returned 0x0 [0317.396] IMarshal:GetUnmarshalClass (in: This=0x58a5b3c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.396] IUnknown:Release (This=0x58a5b3c) returned 0x3 [0317.396] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.396] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.396] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.396] IUnknown:Release (This=0x58a5b38) returned 0x2 [0317.397] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.397] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.397] IUnknown:QueryInterface (in: This=0x58a5b38, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5b38) returned 0x0 [0317.397] IUnknown:AddRef (This=0x58a5b38) returned 0x4 [0317.397] IUnknown:Release (This=0x58a5b38) returned 0x3 [0317.397] IUnknown:Release (This=0x58a5b38) returned 0x2 [0317.397] CoTaskMemFree (pv=0x586b290) [0317.397] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.397] IUnknown:AddRef (This=0x58a5b38) returned 0x3 [0317.397] IWbemClassObject:Get (in: This=0x58a5b38, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.398] IWbemClassObject:Get (in: This=0x58a5b38, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.398] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0317.398] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0317.398] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.398] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.398] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.398] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.400] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b250) returned 0x0 [0317.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b250, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.400] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b250, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3a50) returned 0x0 [0317.400] WbemDefPath:IUnknown:Release (This=0x586b250) returned 0x0 [0317.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3a50) returned 0x0 [0317.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.476] WbemDefPath:IUnknown:AddRef (This=0x6d3a50) returned 0x3 [0317.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4ef0) returned 0x0 [0317.477] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4ef0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.477] WbemDefPath:IUnknown:Release (This=0x58a4ef0) returned 0x3 [0317.477] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.477] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.477] WbemDefPath:IUnknown:Release (This=0x6d3a50) returned 0x2 [0317.478] WbemDefPath:IUnknown:Release (This=0x6d3a50) returned 0x1 [0317.478] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.478] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3a50, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3a50) returned 0x0 [0317.478] WbemDefPath:IUnknown:AddRef (This=0x6d3a50) returned 0x3 [0317.478] WbemDefPath:IUnknown:Release (This=0x6d3a50) returned 0x2 [0317.478] WbemDefPath:IWbemPath:SetText (This=0x6d3a50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x0 [0317.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.479] IWbemClassObject:Get (in: This=0x58a5b38, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232c348*=0, plFlavor=0x232c34c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x232c348*=8, plFlavor=0x232c34c*=0) returned 0x0 [0317.480] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0317.480] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0317.480] IWbemClassObject:Get (in: This=0x58a5b38, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232c348*=8, plFlavor=0x232c34c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x232c348*=8, plFlavor=0x232c34c*=0) returned 0x0 [0317.480] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0317.480] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0317.481] CoTaskMemAlloc (cb=0x4) returned 0x586b0c0 [0317.481] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b0c0, puReturned=0x2320524 | out: apObjects=0x586b0c0*=0x58a5cd0, puReturned=0x2320524*=0x1) returned 0x0 [0317.484] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5cd0) returned 0x0 [0317.484] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.484] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.484] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.485] IUnknown:AddRef (This=0x58a5cd0) returned 0x3 [0317.485] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.485] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.485] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a5cd4) returned 0x0 [0317.485] IMarshal:GetUnmarshalClass (in: This=0x58a5cd4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.485] IUnknown:Release (This=0x58a5cd4) returned 0x3 [0317.485] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.486] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.486] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.486] IUnknown:Release (This=0x58a5cd0) returned 0x2 [0317.486] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.486] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.486] IUnknown:QueryInterface (in: This=0x58a5cd0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5cd0) returned 0x0 [0317.486] IUnknown:AddRef (This=0x58a5cd0) returned 0x4 [0317.486] IUnknown:Release (This=0x58a5cd0) returned 0x3 [0317.486] IUnknown:Release (This=0x58a5cd0) returned 0x2 [0317.486] CoTaskMemFree (pv=0x586b0c0) [0317.486] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.486] IUnknown:AddRef (This=0x58a5cd0) returned 0x3 [0317.487] IWbemClassObject:Get (in: This=0x58a5cd0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.487] IWbemClassObject:Get (in: This=0x58a5cd0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.487] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0317.488] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0317.488] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.488] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.488] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.488] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.490] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b2b0) returned 0x0 [0317.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2b0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.490] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2b0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3f90) returned 0x0 [0317.491] WbemDefPath:IUnknown:Release (This=0x586b2b0) returned 0x0 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3f90) returned 0x0 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.491] WbemDefPath:IUnknown:AddRef (This=0x6d3f90) returned 0x3 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a5160) returned 0x0 [0317.492] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a5160, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.492] WbemDefPath:IUnknown:Release (This=0x58a5160) returned 0x3 [0317.492] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.492] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.492] WbemDefPath:IUnknown:Release (This=0x6d3f90) returned 0x2 [0317.492] WbemDefPath:IUnknown:Release (This=0x6d3f90) returned 0x1 [0317.492] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.492] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3f90, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3f90) returned 0x0 [0317.493] WbemDefPath:IUnknown:AddRef (This=0x6d3f90) returned 0x3 [0317.493] WbemDefPath:IUnknown:Release (This=0x6d3f90) returned 0x2 [0317.493] WbemDefPath:IWbemPath:SetText (This=0x6d3f90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.493] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.493] IWbemClassObject:Get (in: This=0x58a5cd0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232cc1c*=0, plFlavor=0x232cc20*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x232cc1c*=8, plFlavor=0x232cc20*=0) returned 0x0 [0317.494] SysStringByteLen (bstr="yes.exe") returned 0xe [0317.494] SysStringByteLen (bstr="yes.exe") returned 0xe [0317.494] IWbemClassObject:Get (in: This=0x58a5cd0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232cc1c*=8, plFlavor=0x232cc20*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x232cc1c*=8, plFlavor=0x232cc20*=0) returned 0x0 [0317.494] SysStringByteLen (bstr="yes.exe") returned 0xe [0317.494] SysStringByteLen (bstr="yes.exe") returned 0xe [0317.494] CoTaskMemAlloc (cb=0x4) returned 0x586b200 [0317.494] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b200, puReturned=0x2320524 | out: apObjects=0x586b200*=0x58a54d8, puReturned=0x2320524*=0x1) returned 0x0 [0317.497] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a54d8) returned 0x0 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.498] IUnknown:AddRef (This=0x58a54d8) returned 0x3 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.498] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a54dc) returned 0x0 [0317.499] IMarshal:GetUnmarshalClass (in: This=0x58a54dc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.499] IUnknown:Release (This=0x58a54dc) returned 0x3 [0317.499] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.499] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.499] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.499] IUnknown:Release (This=0x58a54d8) returned 0x2 [0317.499] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.499] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.499] IUnknown:QueryInterface (in: This=0x58a54d8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a54d8) returned 0x0 [0317.499] IUnknown:AddRef (This=0x58a54d8) returned 0x4 [0317.499] IUnknown:Release (This=0x58a54d8) returned 0x3 [0317.500] IUnknown:Release (This=0x58a54d8) returned 0x2 [0317.500] CoTaskMemFree (pv=0x586b200) [0317.500] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.500] IUnknown:AddRef (This=0x58a54d8) returned 0x3 [0317.501] IWbemClassObject:Get (in: This=0x58a54d8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.501] IWbemClassObject:Get (in: This=0x58a54d8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.502] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0317.502] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0317.502] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.502] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.502] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.502] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.504] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1e0) returned 0x0 [0317.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.504] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4070) returned 0x0 [0317.504] WbemDefPath:IUnknown:Release (This=0x586b1e0) returned 0x0 [0317.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4070) returned 0x0 [0317.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.505] WbemDefPath:IUnknown:AddRef (This=0x6d4070) returned 0x3 [0317.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3420) returned 0x0 [0317.505] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3420, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.506] WbemDefPath:IUnknown:Release (This=0x58a3420) returned 0x3 [0317.506] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.506] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.506] WbemDefPath:IUnknown:Release (This=0x6d4070) returned 0x2 [0317.506] WbemDefPath:IUnknown:Release (This=0x6d4070) returned 0x1 [0317.506] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.506] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4070, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4070) returned 0x0 [0317.506] WbemDefPath:IUnknown:AddRef (This=0x6d4070) returned 0x3 [0317.506] WbemDefPath:IUnknown:Release (This=0x6d4070) returned 0x2 [0317.506] WbemDefPath:IWbemPath:SetText (This=0x6d4070, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.507] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.507] IWbemClassObject:Get (in: This=0x58a54d8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232d498*=0, plFlavor=0x232d49c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x232d498*=8, plFlavor=0x232d49c*=0) returned 0x0 [0317.507] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0317.507] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0317.507] IWbemClassObject:Get (in: This=0x58a54d8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232d498*=8, plFlavor=0x232d49c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x232d498*=8, plFlavor=0x232d49c*=0) returned 0x0 [0317.508] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0317.508] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0317.508] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0317.508] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x58a64c8, puReturned=0x2320524*=0x1) returned 0x0 [0317.668] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a64c8) returned 0x0 [0317.668] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.668] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.668] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.669] IUnknown:AddRef (This=0x58a64c8) returned 0x3 [0317.669] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.669] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.669] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a64cc) returned 0x0 [0317.669] IMarshal:GetUnmarshalClass (in: This=0x58a64cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.669] IUnknown:Release (This=0x58a64cc) returned 0x3 [0317.669] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.669] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.669] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.670] IUnknown:Release (This=0x58a64c8) returned 0x2 [0317.670] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.670] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.670] IUnknown:QueryInterface (in: This=0x58a64c8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a64c8) returned 0x0 [0317.670] IUnknown:AddRef (This=0x58a64c8) returned 0x4 [0317.670] IUnknown:Release (This=0x58a64c8) returned 0x3 [0317.670] IUnknown:Release (This=0x58a64c8) returned 0x2 [0317.670] CoTaskMemFree (pv=0x586b170) [0317.670] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.670] IUnknown:AddRef (This=0x58a64c8) returned 0x3 [0317.670] IWbemClassObject:Get (in: This=0x58a64c8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.670] IWbemClassObject:Get (in: This=0x58a64c8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.671] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0317.671] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0317.671] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.671] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.671] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.671] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.672] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0317.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.673] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4150) returned 0x0 [0317.673] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0317.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4150) returned 0x0 [0317.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.673] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.674] WbemDefPath:IUnknown:AddRef (This=0x6d4150) returned 0x3 [0317.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3318) returned 0x0 [0317.674] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3318, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.674] WbemDefPath:IUnknown:Release (This=0x58a3318) returned 0x3 [0317.674] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.674] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.674] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.675] WbemDefPath:IUnknown:Release (This=0x6d4150) returned 0x2 [0317.675] WbemDefPath:IUnknown:Release (This=0x6d4150) returned 0x1 [0317.675] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.675] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.675] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4150, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4150) returned 0x0 [0317.675] WbemDefPath:IUnknown:AddRef (This=0x6d4150) returned 0x3 [0317.675] WbemDefPath:IUnknown:Release (This=0x6d4150) returned 0x2 [0317.675] WbemDefPath:IWbemPath:SetText (This=0x6d4150, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x0 [0317.675] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.675] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.675] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.675] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.675] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.676] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.676] IWbemClassObject:Get (in: This=0x58a64c8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232dd64*=0, plFlavor=0x232dd68*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x232dd64*=8, plFlavor=0x232dd68*=0) returned 0x0 [0317.676] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0317.676] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0317.676] IWbemClassObject:Get (in: This=0x58a64c8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232dd64*=8, plFlavor=0x232dd68*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x232dd64*=8, plFlavor=0x232dd68*=0) returned 0x0 [0317.676] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0317.677] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0317.677] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0317.677] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x58a6660, puReturned=0x2320524*=0x1) returned 0x0 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6660) returned 0x0 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.679] IUnknown:AddRef (This=0x58a6660) returned 0x3 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.679] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.680] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6664) returned 0x0 [0317.680] IMarshal:GetUnmarshalClass (in: This=0x58a6664, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.680] IUnknown:Release (This=0x58a6664) returned 0x3 [0317.680] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.680] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.680] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.680] IUnknown:Release (This=0x58a6660) returned 0x2 [0317.680] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.680] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.681] IUnknown:QueryInterface (in: This=0x58a6660, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6660) returned 0x0 [0317.681] IUnknown:AddRef (This=0x58a6660) returned 0x4 [0317.681] IUnknown:Release (This=0x58a6660) returned 0x3 [0317.681] IUnknown:Release (This=0x58a6660) returned 0x2 [0317.681] CoTaskMemFree (pv=0x586b170) [0317.681] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.681] IUnknown:AddRef (This=0x58a6660) returned 0x3 [0317.681] IWbemClassObject:Get (in: This=0x58a6660, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.681] IWbemClassObject:Get (in: This=0x58a6660, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.682] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0317.682] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0317.683] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.683] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.683] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.683] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.684] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0c0) returned 0x0 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.685] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3890) returned 0x0 [0317.685] WbemDefPath:IUnknown:Release (This=0x586b0c0) returned 0x0 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3890) returned 0x0 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.685] WbemDefPath:IUnknown:AddRef (This=0x6d3890) returned 0x3 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.685] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3768) returned 0x0 [0317.686] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3768, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.686] WbemDefPath:IUnknown:Release (This=0x58a3768) returned 0x3 [0317.686] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.686] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.686] WbemDefPath:IUnknown:Release (This=0x6d3890) returned 0x2 [0317.686] WbemDefPath:IUnknown:Release (This=0x6d3890) returned 0x1 [0317.686] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.686] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.686] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3890, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3890) returned 0x0 [0317.686] WbemDefPath:IUnknown:AddRef (This=0x6d3890) returned 0x3 [0317.686] WbemDefPath:IUnknown:Release (This=0x6d3890) returned 0x2 [0317.686] WbemDefPath:IWbemPath:SetText (This=0x6d3890, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.687] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.687] IWbemClassObject:Get (in: This=0x58a6660, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232e600*=0, plFlavor=0x232e604*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x232e600*=8, plFlavor=0x232e604*=0) returned 0x0 [0317.687] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0317.688] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0317.688] IWbemClassObject:Get (in: This=0x58a6660, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232e600*=8, plFlavor=0x232e604*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x232e600*=8, plFlavor=0x232e604*=0) returned 0x0 [0317.688] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0317.688] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0317.688] CoTaskMemAlloc (cb=0x4) returned 0x586b250 [0317.688] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b250, puReturned=0x2320524 | out: apObjects=0x586b250*=0x58a6198, puReturned=0x2320524*=0x1) returned 0x0 [0317.693] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6198) returned 0x0 [0317.693] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.693] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.694] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.694] IUnknown:AddRef (This=0x58a6198) returned 0x3 [0317.694] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.694] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.694] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a619c) returned 0x0 [0317.694] IMarshal:GetUnmarshalClass (in: This=0x58a619c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.694] IUnknown:Release (This=0x58a619c) returned 0x3 [0317.695] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.695] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.695] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.695] IUnknown:Release (This=0x58a6198) returned 0x2 [0317.695] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.695] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.695] IUnknown:QueryInterface (in: This=0x58a6198, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6198) returned 0x0 [0317.695] IUnknown:AddRef (This=0x58a6198) returned 0x4 [0317.695] IUnknown:Release (This=0x58a6198) returned 0x3 [0317.695] IUnknown:Release (This=0x58a6198) returned 0x2 [0317.696] CoTaskMemFree (pv=0x586b250) [0317.696] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.696] IUnknown:AddRef (This=0x58a6198) returned 0x3 [0317.696] IWbemClassObject:Get (in: This=0x58a6198, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.696] IWbemClassObject:Get (in: This=0x58a6198, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.696] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0317.696] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0317.697] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.697] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.697] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.697] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.810] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1d0) returned 0x0 [0317.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1d0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.810] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1d0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3740) returned 0x0 [0317.810] WbemDefPath:IUnknown:Release (This=0x586b1d0) returned 0x0 [0317.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3740) returned 0x0 [0317.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.811] WbemDefPath:IUnknown:AddRef (This=0x6d3740) returned 0x3 [0317.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3780) returned 0x0 [0317.811] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3780, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.811] WbemDefPath:IUnknown:Release (This=0x58a3780) returned 0x3 [0317.812] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.812] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.812] WbemDefPath:IUnknown:Release (This=0x6d3740) returned 0x2 [0317.812] WbemDefPath:IUnknown:Release (This=0x6d3740) returned 0x1 [0317.812] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.812] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3740, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3740) returned 0x0 [0317.812] WbemDefPath:IUnknown:AddRef (This=0x6d3740) returned 0x3 [0317.812] WbemDefPath:IUnknown:Release (This=0x6d3740) returned 0x2 [0317.812] WbemDefPath:IWbemPath:SetText (This=0x6d3740, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.813] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.813] IWbemClassObject:Get (in: This=0x58a6198, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232eeac*=0, plFlavor=0x232eeb0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x232eeac*=8, plFlavor=0x232eeb0*=0) returned 0x0 [0317.813] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0317.813] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0317.814] IWbemClassObject:Get (in: This=0x58a6198, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232eeac*=8, plFlavor=0x232eeb0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x232eeac*=8, plFlavor=0x232eeb0*=0) returned 0x0 [0317.814] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0317.814] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0317.814] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0317.814] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x58a5e68, puReturned=0x2320524*=0x1) returned 0x0 [0317.819] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5e68) returned 0x0 [0317.819] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.819] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.819] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.820] IUnknown:AddRef (This=0x58a5e68) returned 0x3 [0317.820] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.820] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.820] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a5e6c) returned 0x0 [0317.820] IMarshal:GetUnmarshalClass (in: This=0x58a5e6c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.820] IUnknown:Release (This=0x58a5e6c) returned 0x3 [0317.820] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.820] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.820] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.821] IUnknown:Release (This=0x58a5e68) returned 0x2 [0317.821] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.821] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.821] IUnknown:QueryInterface (in: This=0x58a5e68, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5e68) returned 0x0 [0317.821] IUnknown:AddRef (This=0x58a5e68) returned 0x4 [0317.821] IUnknown:Release (This=0x58a5e68) returned 0x3 [0317.821] IUnknown:Release (This=0x58a5e68) returned 0x2 [0317.821] CoTaskMemFree (pv=0x586b1c0) [0317.821] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.821] IUnknown:AddRef (This=0x58a5e68) returned 0x3 [0317.821] IWbemClassObject:Get (in: This=0x58a5e68, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.822] IWbemClassObject:Get (in: This=0x58a5e68, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0317.822] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0317.822] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.822] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.822] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.837] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0f0) returned 0x0 [0317.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0f0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.837] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0f0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d40e0) returned 0x0 [0317.837] WbemDefPath:IUnknown:Release (This=0x586b0f0) returned 0x0 [0317.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d40e0) returned 0x0 [0317.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.838] WbemDefPath:IUnknown:AddRef (This=0x6d40e0) returned 0x3 [0317.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a37f8) returned 0x0 [0317.839] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a37f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.839] WbemDefPath:IUnknown:Release (This=0x58a37f8) returned 0x3 [0317.839] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.839] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.840] WbemDefPath:IUnknown:Release (This=0x6d40e0) returned 0x2 [0317.840] WbemDefPath:IUnknown:Release (This=0x6d40e0) returned 0x1 [0317.840] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.840] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d40e0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d40e0) returned 0x0 [0317.840] WbemDefPath:IUnknown:AddRef (This=0x6d40e0) returned 0x3 [0317.840] WbemDefPath:IUnknown:Release (This=0x6d40e0) returned 0x2 [0317.840] WbemDefPath:IWbemPath:SetText (This=0x6d40e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x0 [0317.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.841] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.841] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.841] IWbemClassObject:Get (in: This=0x58a5e68, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232f740*=0, plFlavor=0x232f744*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x232f740*=8, plFlavor=0x232f744*=0) returned 0x0 [0317.841] SysStringByteLen (bstr="spend.exe") returned 0x12 [0317.841] SysStringByteLen (bstr="spend.exe") returned 0x12 [0317.841] IWbemClassObject:Get (in: This=0x58a5e68, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232f740*=8, plFlavor=0x232f744*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x232f740*=8, plFlavor=0x232f744*=0) returned 0x0 [0317.841] SysStringByteLen (bstr="spend.exe") returned 0x12 [0317.842] SysStringByteLen (bstr="spend.exe") returned 0x12 [0317.842] CoTaskMemAlloc (cb=0x4) returned 0x586b290 [0317.842] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b290, puReturned=0x2320524 | out: apObjects=0x586b290*=0x58a6000, puReturned=0x2320524*=0x1) returned 0x0 [0317.845] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6000) returned 0x0 [0317.845] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.845] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.845] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.846] IUnknown:AddRef (This=0x58a6000) returned 0x3 [0317.846] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.846] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.846] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6004) returned 0x0 [0317.846] IMarshal:GetUnmarshalClass (in: This=0x58a6004, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.846] IUnknown:Release (This=0x58a6004) returned 0x3 [0317.846] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.846] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.846] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.847] IUnknown:Release (This=0x58a6000) returned 0x2 [0317.847] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.847] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.847] IUnknown:QueryInterface (in: This=0x58a6000, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6000) returned 0x0 [0317.847] IUnknown:AddRef (This=0x58a6000) returned 0x4 [0317.847] IUnknown:Release (This=0x58a6000) returned 0x3 [0317.847] IUnknown:Release (This=0x58a6000) returned 0x2 [0317.847] CoTaskMemFree (pv=0x586b290) [0317.847] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.847] IUnknown:AddRef (This=0x58a6000) returned 0x3 [0317.847] IWbemClassObject:Get (in: This=0x58a6000, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.848] IWbemClassObject:Get (in: This=0x58a6000, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.848] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0317.848] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0317.848] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.848] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.848] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.848] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.850] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b130) returned 0x0 [0317.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b130, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.850] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b130, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d36d0) returned 0x0 [0317.850] WbemDefPath:IUnknown:Release (This=0x586b130) returned 0x0 [0317.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d36d0) returned 0x0 [0317.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.851] WbemDefPath:IUnknown:AddRef (This=0x6d36d0) returned 0x3 [0317.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3900) returned 0x0 [0317.851] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.851] WbemDefPath:IUnknown:Release (This=0x58a3900) returned 0x3 [0317.851] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.851] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.851] WbemDefPath:IUnknown:Release (This=0x6d36d0) returned 0x2 [0317.851] WbemDefPath:IUnknown:Release (This=0x6d36d0) returned 0x1 [0317.851] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.851] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d36d0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d36d0) returned 0x0 [0317.852] WbemDefPath:IUnknown:AddRef (This=0x6d36d0) returned 0x3 [0317.852] WbemDefPath:IUnknown:Release (This=0x6d36d0) returned 0x2 [0317.852] WbemDefPath:IWbemPath:SetText (This=0x6d36d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.852] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.852] IWbemClassObject:Get (in: This=0x58a6000, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232ffc4*=0, plFlavor=0x232ffc8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x232ffc4*=8, plFlavor=0x232ffc8*=0) returned 0x0 [0317.853] SysStringByteLen (bstr="fall.exe") returned 0x10 [0317.853] SysStringByteLen (bstr="fall.exe") returned 0x10 [0317.853] IWbemClassObject:Get (in: This=0x58a6000, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x232ffc4*=8, plFlavor=0x232ffc8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x232ffc4*=8, plFlavor=0x232ffc8*=0) returned 0x0 [0317.853] SysStringByteLen (bstr="fall.exe") returned 0x10 [0317.853] SysStringByteLen (bstr="fall.exe") returned 0x10 [0317.853] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0317.853] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x58a6b28, puReturned=0x2320524*=0x1) returned 0x0 [0317.857] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6b28) returned 0x0 [0317.857] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.857] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.857] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.857] IUnknown:AddRef (This=0x58a6b28) returned 0x3 [0317.858] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.858] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.858] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6b2c) returned 0x0 [0317.858] IMarshal:GetUnmarshalClass (in: This=0x58a6b2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.858] IUnknown:Release (This=0x58a6b2c) returned 0x3 [0317.858] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.858] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.858] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.858] IUnknown:Release (This=0x58a6b28) returned 0x2 [0317.858] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.858] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.858] IUnknown:QueryInterface (in: This=0x58a6b28, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6b28) returned 0x0 [0317.858] IUnknown:AddRef (This=0x58a6b28) returned 0x4 [0317.859] IUnknown:Release (This=0x58a6b28) returned 0x3 [0317.859] IUnknown:Release (This=0x58a6b28) returned 0x2 [0317.859] CoTaskMemFree (pv=0x586b170) [0317.859] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.859] IUnknown:AddRef (This=0x58a6b28) returned 0x3 [0317.859] IWbemClassObject:Get (in: This=0x58a6b28, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.859] IWbemClassObject:Get (in: This=0x58a6b28, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.859] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0317.859] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0317.859] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.860] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.860] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.860] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.861] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0317.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.861] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d37b0) returned 0x0 [0317.861] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0317.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d37b0) returned 0x0 [0317.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.862] WbemDefPath:IUnknown:AddRef (This=0x6d37b0) returned 0x3 [0317.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3db0) returned 0x0 [0317.862] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3db0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.862] WbemDefPath:IUnknown:Release (This=0x58a3db0) returned 0x3 [0317.862] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.862] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.863] WbemDefPath:IUnknown:Release (This=0x6d37b0) returned 0x2 [0317.863] WbemDefPath:IUnknown:Release (This=0x6d37b0) returned 0x1 [0317.863] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.863] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d37b0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d37b0) returned 0x0 [0317.863] WbemDefPath:IUnknown:AddRef (This=0x6d37b0) returned 0x3 [0317.863] WbemDefPath:IUnknown:Release (This=0x6d37b0) returned 0x2 [0317.863] WbemDefPath:IWbemPath:SetText (This=0x6d37b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x0 [0317.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.863] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.863] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.864] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.864] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.864] IWbemClassObject:Get (in: This=0x58a6b28, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2330848*=0, plFlavor=0x233084c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x2330848*=8, plFlavor=0x233084c*=0) returned 0x0 [0317.864] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0317.864] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0317.864] IWbemClassObject:Get (in: This=0x58a6b28, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2330848*=8, plFlavor=0x233084c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x2330848*=8, plFlavor=0x233084c*=0) returned 0x0 [0317.864] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0317.864] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0317.865] CoTaskMemAlloc (cb=0x4) returned 0x586b240 [0317.865] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b240, puReturned=0x2320524 | out: apObjects=0x586b240*=0x58a67f8, puReturned=0x2320524*=0x1) returned 0x0 [0317.915] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a67f8) returned 0x0 [0317.915] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.915] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.916] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.916] IUnknown:AddRef (This=0x58a67f8) returned 0x3 [0317.916] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.916] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.916] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a67fc) returned 0x0 [0317.916] IMarshal:GetUnmarshalClass (in: This=0x58a67fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.917] IUnknown:Release (This=0x58a67fc) returned 0x3 [0317.917] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.917] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.917] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.917] IUnknown:Release (This=0x58a67f8) returned 0x2 [0317.917] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.917] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.918] IUnknown:QueryInterface (in: This=0x58a67f8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a67f8) returned 0x0 [0317.918] IUnknown:AddRef (This=0x58a67f8) returned 0x4 [0317.918] IUnknown:Release (This=0x58a67f8) returned 0x3 [0317.918] IUnknown:Release (This=0x58a67f8) returned 0x2 [0317.918] CoTaskMemFree (pv=0x586b240) [0317.918] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.918] IUnknown:AddRef (This=0x58a67f8) returned 0x3 [0317.918] IWbemClassObject:Get (in: This=0x58a67f8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.919] IWbemClassObject:Get (in: This=0x58a67f8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.919] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0317.919] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0317.919] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.919] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.919] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.919] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.921] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0e0) returned 0x0 [0317.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.921] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4230) returned 0x0 [0317.921] WbemDefPath:IUnknown:Release (This=0x586b0e0) returned 0x0 [0317.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4230) returned 0x0 [0317.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.922] WbemDefPath:IUnknown:AddRef (This=0x6d4230) returned 0x3 [0317.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3ae0) returned 0x0 [0317.922] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3ae0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.922] WbemDefPath:IUnknown:Release (This=0x58a3ae0) returned 0x3 [0317.922] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.922] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.923] WbemDefPath:IUnknown:Release (This=0x6d4230) returned 0x2 [0317.923] WbemDefPath:IUnknown:Release (This=0x6d4230) returned 0x1 [0317.923] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.923] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4230, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4230) returned 0x0 [0317.923] WbemDefPath:IUnknown:AddRef (This=0x6d4230) returned 0x3 [0317.923] WbemDefPath:IUnknown:Release (This=0x6d4230) returned 0x2 [0317.923] WbemDefPath:IWbemPath:SetText (This=0x6d4230, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x0 [0317.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.923] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.923] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.924] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.924] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.924] IWbemClassObject:Get (in: This=0x58a67f8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23310cc*=0, plFlavor=0x23310d0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x23310cc*=8, plFlavor=0x23310d0*=0) returned 0x0 [0317.924] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0317.924] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0317.924] IWbemClassObject:Get (in: This=0x58a67f8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23310cc*=8, plFlavor=0x23310d0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x23310cc*=8, plFlavor=0x23310d0*=0) returned 0x0 [0317.924] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0317.924] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0317.925] CoTaskMemAlloc (cb=0x4) returned 0x586b250 [0317.925] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b250, puReturned=0x2320524 | out: apObjects=0x586b250*=0x58a6990, puReturned=0x2320524*=0x1) returned 0x0 [0317.926] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6990) returned 0x0 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.927] IUnknown:AddRef (This=0x58a6990) returned 0x3 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.927] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6994) returned 0x0 [0317.927] IMarshal:GetUnmarshalClass (in: This=0x58a6994, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.928] IUnknown:Release (This=0x58a6994) returned 0x3 [0317.928] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.928] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.928] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.928] IUnknown:Release (This=0x58a6990) returned 0x2 [0317.928] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.928] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.928] IUnknown:QueryInterface (in: This=0x58a6990, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6990) returned 0x0 [0317.928] IUnknown:AddRef (This=0x58a6990) returned 0x4 [0317.928] IUnknown:Release (This=0x58a6990) returned 0x3 [0317.928] IUnknown:Release (This=0x58a6990) returned 0x2 [0317.929] CoTaskMemFree (pv=0x586b250) [0317.929] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.929] IUnknown:AddRef (This=0x58a6990) returned 0x3 [0317.929] IWbemClassObject:Get (in: This=0x58a6990, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.929] IWbemClassObject:Get (in: This=0x58a6990, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.929] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0317.929] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0317.930] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.930] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.930] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.930] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.931] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1d0) returned 0x0 [0317.931] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1d0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.931] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1d0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3900) returned 0x0 [0317.932] WbemDefPath:IUnknown:Release (This=0x586b1d0) returned 0x0 [0317.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3900) returned 0x0 [0317.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.932] WbemDefPath:IUnknown:AddRef (This=0x6d3900) returned 0x3 [0317.932] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a3ee8) returned 0x0 [0317.933] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a3ee8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.933] WbemDefPath:IUnknown:Release (This=0x58a3ee8) returned 0x3 [0317.933] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.933] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.933] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.933] WbemDefPath:IUnknown:Release (This=0x6d3900) returned 0x2 [0317.933] WbemDefPath:IUnknown:Release (This=0x6d3900) returned 0x1 [0317.933] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.934] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.934] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3900, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3900) returned 0x0 [0317.934] WbemDefPath:IUnknown:AddRef (This=0x6d3900) returned 0x3 [0317.934] WbemDefPath:IUnknown:Release (This=0x6d3900) returned 0x2 [0317.934] WbemDefPath:IWbemPath:SetText (This=0x6d3900, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.934] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.934] IWbemClassObject:Get (in: This=0x58a6990, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2331978*=0, plFlavor=0x233197c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2331978*=8, plFlavor=0x233197c*=0) returned 0x0 [0317.934] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0317.935] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0317.935] IWbemClassObject:Get (in: This=0x58a6990, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2331978*=8, plFlavor=0x233197c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2331978*=8, plFlavor=0x233197c*=0) returned 0x0 [0317.935] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0317.935] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0317.935] CoTaskMemAlloc (cb=0x4) returned 0x586b2b0 [0317.935] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b2b0, puReturned=0x2320524 | out: apObjects=0x586b2b0*=0x58a6cc0, puReturned=0x2320524*=0x1) returned 0x0 [0317.937] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6cc0) returned 0x0 [0317.937] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0317.937] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0317.937] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0317.938] IUnknown:AddRef (This=0x58a6cc0) returned 0x3 [0317.938] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0317.938] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0317.938] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6cc4) returned 0x0 [0317.938] IMarshal:GetUnmarshalClass (in: This=0x58a6cc4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0317.938] IUnknown:Release (This=0x58a6cc4) returned 0x3 [0317.938] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0317.938] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0317.938] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0317.939] IUnknown:Release (This=0x58a6cc0) returned 0x2 [0317.939] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0317.939] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0317.939] IUnknown:QueryInterface (in: This=0x58a6cc0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6cc0) returned 0x0 [0317.939] IUnknown:AddRef (This=0x58a6cc0) returned 0x4 [0317.939] IUnknown:Release (This=0x58a6cc0) returned 0x3 [0317.939] IUnknown:Release (This=0x58a6cc0) returned 0x2 [0317.939] CoTaskMemFree (pv=0x586b2b0) [0317.939] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0317.939] IUnknown:AddRef (This=0x58a6cc0) returned 0x3 [0317.939] IWbemClassObject:Get (in: This=0x58a6cc0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0317.940] IWbemClassObject:Get (in: This=0x58a6cc0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0317.940] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0317.940] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0317.940] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0317.940] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0317.940] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0317.940] IUnknown:Release (This=0x692bc4) returned 0x1 [0317.942] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1c0) returned 0x0 [0317.942] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0317.942] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3c10) returned 0x0 [0317.942] WbemDefPath:IUnknown:Release (This=0x586b1c0) returned 0x0 [0317.942] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3c10) returned 0x0 [0317.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0317.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0317.943] WbemDefPath:IUnknown:AddRef (This=0x6d3c10) returned 0x3 [0317.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0317.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0317.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a40b0) returned 0x0 [0317.943] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a40b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0317.943] WbemDefPath:IUnknown:Release (This=0x58a40b0) returned 0x3 [0317.944] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0317.944] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0317.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0317.944] WbemDefPath:IUnknown:Release (This=0x6d3c10) returned 0x2 [0317.944] WbemDefPath:IUnknown:Release (This=0x6d3c10) returned 0x1 [0317.944] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0317.944] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0317.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c10, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3c10) returned 0x0 [0317.944] WbemDefPath:IUnknown:AddRef (This=0x6d3c10) returned 0x3 [0317.944] WbemDefPath:IUnknown:Release (This=0x6d3c10) returned 0x2 [0317.944] WbemDefPath:IWbemPath:SetText (This=0x6d3c10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0317.945] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0317.945] IWbemClassObject:Get (in: This=0x58a6cc0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23321fc*=0, plFlavor=0x2332200*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x23321fc*=8, plFlavor=0x2332200*=0) returned 0x0 [0317.945] SysStringByteLen (bstr="barca.exe") returned 0x12 [0317.945] SysStringByteLen (bstr="barca.exe") returned 0x12 [0317.946] IWbemClassObject:Get (in: This=0x58a6cc0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23321fc*=8, plFlavor=0x2332200*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x23321fc*=8, plFlavor=0x2332200*=0) returned 0x0 [0317.946] SysStringByteLen (bstr="barca.exe") returned 0x12 [0317.946] SysStringByteLen (bstr="barca.exe") returned 0x12 [0317.946] CoTaskMemAlloc (cb=0x4) returned 0x586b0d0 [0317.946] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b0d0, puReturned=0x2320524 | out: apObjects=0x586b0d0*=0x58a6e58, puReturned=0x2320524*=0x1) returned 0x0 [0318.047] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a6e58) returned 0x0 [0318.047] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.047] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.047] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.048] IUnknown:AddRef (This=0x58a6e58) returned 0x3 [0318.048] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.048] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.048] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a6e5c) returned 0x0 [0318.048] IMarshal:GetUnmarshalClass (in: This=0x58a6e5c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.048] IUnknown:Release (This=0x58a6e5c) returned 0x3 [0318.048] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.048] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.048] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.049] IUnknown:Release (This=0x58a6e58) returned 0x2 [0318.049] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.049] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.049] IUnknown:QueryInterface (in: This=0x58a6e58, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a6e58) returned 0x0 [0318.049] IUnknown:AddRef (This=0x58a6e58) returned 0x4 [0318.049] IUnknown:Release (This=0x58a6e58) returned 0x3 [0318.049] IUnknown:Release (This=0x58a6e58) returned 0x2 [0318.049] CoTaskMemFree (pv=0x586b0d0) [0318.049] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.049] IUnknown:AddRef (This=0x58a6e58) returned 0x3 [0318.049] IWbemClassObject:Get (in: This=0x58a6e58, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.050] IWbemClassObject:Get (in: This=0x58a6e58, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.050] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0318.050] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0318.050] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.050] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.050] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.051] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.052] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b170) returned 0x0 [0318.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b170, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.053] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b170, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d41c0) returned 0x0 [0318.053] WbemDefPath:IUnknown:Release (This=0x586b170) returned 0x0 [0318.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d41c0) returned 0x0 [0318.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.054] WbemDefPath:IUnknown:AddRef (This=0x6d41c0) returned 0x3 [0318.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4248) returned 0x0 [0318.054] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4248, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.054] WbemDefPath:IUnknown:Release (This=0x58a4248) returned 0x3 [0318.054] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.054] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.054] WbemDefPath:IUnknown:Release (This=0x6d41c0) returned 0x2 [0318.054] WbemDefPath:IUnknown:Release (This=0x6d41c0) returned 0x1 [0318.055] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.055] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d41c0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d41c0) returned 0x0 [0318.055] WbemDefPath:IUnknown:AddRef (This=0x6d41c0) returned 0x3 [0318.055] WbemDefPath:IUnknown:Release (This=0x6d41c0) returned 0x2 [0318.055] WbemDefPath:IWbemPath:SetText (This=0x6d41c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.055] IWbemClassObject:Get (in: This=0x58a6e58, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2332a80*=0, plFlavor=0x2332a84*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2332a80*=8, plFlavor=0x2332a84*=0) returned 0x0 [0318.056] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0318.056] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0318.056] IWbemClassObject:Get (in: This=0x58a6e58, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2332a80*=8, plFlavor=0x2332a84*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2332a80*=8, plFlavor=0x2332a84*=0) returned 0x0 [0318.056] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0318.056] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0318.056] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0318.056] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x58a51a8, puReturned=0x2320524*=0x1) returned 0x0 [0318.060] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a51a8) returned 0x0 [0318.060] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.060] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.060] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.061] IUnknown:AddRef (This=0x58a51a8) returned 0x3 [0318.061] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.061] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.061] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a51ac) returned 0x0 [0318.061] IMarshal:GetUnmarshalClass (in: This=0x58a51ac, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.061] IUnknown:Release (This=0x58a51ac) returned 0x3 [0318.061] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.062] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.062] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.062] IUnknown:Release (This=0x58a51a8) returned 0x2 [0318.062] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.062] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.062] IUnknown:QueryInterface (in: This=0x58a51a8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a51a8) returned 0x0 [0318.062] IUnknown:AddRef (This=0x58a51a8) returned 0x4 [0318.062] IUnknown:Release (This=0x58a51a8) returned 0x3 [0318.062] IUnknown:Release (This=0x58a51a8) returned 0x2 [0318.062] CoTaskMemFree (pv=0x586b220) [0318.062] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.063] IUnknown:AddRef (This=0x58a51a8) returned 0x3 [0318.063] IWbemClassObject:Get (in: This=0x58a51a8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.063] IWbemClassObject:Get (in: This=0x58a51a8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.063] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0318.063] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0318.063] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.064] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.064] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.064] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.066] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b290) returned 0x0 [0318.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b290, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b290, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3c80) returned 0x0 [0318.066] WbemDefPath:IUnknown:Release (This=0x586b290) returned 0x0 [0318.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3c80) returned 0x0 [0318.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.067] WbemDefPath:IUnknown:AddRef (This=0x6d3c80) returned 0x3 [0318.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4158) returned 0x0 [0318.067] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4158, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.067] WbemDefPath:IUnknown:Release (This=0x58a4158) returned 0x3 [0318.067] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.068] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.068] WbemDefPath:IUnknown:Release (This=0x6d3c80) returned 0x2 [0318.068] WbemDefPath:IUnknown:Release (This=0x6d3c80) returned 0x1 [0318.068] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.068] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.068] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3c80, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3c80) returned 0x0 [0318.068] WbemDefPath:IUnknown:AddRef (This=0x6d3c80) returned 0x3 [0318.068] WbemDefPath:IUnknown:Release (This=0x6d3c80) returned 0x2 [0318.069] WbemDefPath:IWbemPath:SetText (This=0x6d3c80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.069] IWbemClassObject:Get (in: This=0x58a51a8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2333314*=0, plFlavor=0x2333318*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x2333314*=8, plFlavor=0x2333318*=0) returned 0x0 [0318.069] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0318.070] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0318.070] IWbemClassObject:Get (in: This=0x58a51a8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2333314*=8, plFlavor=0x2333318*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x2333314*=8, plFlavor=0x2333318*=0) returned 0x0 [0318.070] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0318.070] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0318.070] CoTaskMemAlloc (cb=0x4) returned 0x586b220 [0318.070] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b220, puReturned=0x2320524 | out: apObjects=0x586b220*=0x58a5340, puReturned=0x2320524*=0x1) returned 0x0 [0318.072] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58a5340) returned 0x0 [0318.074] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.074] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.074] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.075] IUnknown:AddRef (This=0x58a5340) returned 0x3 [0318.075] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.075] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.075] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58a5344) returned 0x0 [0318.075] IMarshal:GetUnmarshalClass (in: This=0x58a5344, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.075] IUnknown:Release (This=0x58a5344) returned 0x3 [0318.075] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.075] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.076] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.076] IUnknown:Release (This=0x58a5340) returned 0x2 [0318.076] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.076] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.076] IUnknown:QueryInterface (in: This=0x58a5340, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58a5340) returned 0x0 [0318.076] IUnknown:AddRef (This=0x58a5340) returned 0x4 [0318.076] IUnknown:Release (This=0x58a5340) returned 0x3 [0318.076] IUnknown:Release (This=0x58a5340) returned 0x2 [0318.076] CoTaskMemFree (pv=0x586b220) [0318.076] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.076] IUnknown:AddRef (This=0x58a5340) returned 0x3 [0318.077] IWbemClassObject:Get (in: This=0x58a5340, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.077] IWbemClassObject:Get (in: This=0x58a5340, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.077] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0318.077] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0318.077] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.078] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.078] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.078] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.079] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.080] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3dd0) returned 0x0 [0318.080] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3dd0) returned 0x0 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.080] WbemDefPath:IUnknown:AddRef (This=0x6d3dd0) returned 0x3 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.080] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4428) returned 0x0 [0318.081] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4428, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.081] WbemDefPath:IUnknown:Release (This=0x58a4428) returned 0x3 [0318.081] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.081] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.081] WbemDefPath:IUnknown:Release (This=0x6d3dd0) returned 0x2 [0318.081] WbemDefPath:IUnknown:Release (This=0x6d3dd0) returned 0x1 [0318.081] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.081] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.081] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3dd0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3dd0) returned 0x0 [0318.082] WbemDefPath:IUnknown:AddRef (This=0x6d3dd0) returned 0x3 [0318.082] WbemDefPath:IUnknown:Release (This=0x6d3dd0) returned 0x2 [0318.082] WbemDefPath:IWbemPath:SetText (This=0x6d3dd0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.082] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.082] IWbemClassObject:Get (in: This=0x58a5340, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2333ba0*=0, plFlavor=0x2333ba4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x2333ba0*=8, plFlavor=0x2333ba4*=0) returned 0x0 [0318.083] SysStringByteLen (bstr="far.exe") returned 0xe [0318.083] SysStringByteLen (bstr="far.exe") returned 0xe [0318.083] IWbemClassObject:Get (in: This=0x58a5340, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2333ba0*=8, plFlavor=0x2333ba4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x2333ba0*=8, plFlavor=0x2333ba4*=0) returned 0x0 [0318.083] SysStringByteLen (bstr="far.exe") returned 0xe [0318.083] SysStringByteLen (bstr="far.exe") returned 0xe [0318.083] CoTaskMemAlloc (cb=0x4) returned 0x586b180 [0318.083] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b180, puReturned=0x2320524 | out: apObjects=0x586b180*=0x587e258, puReturned=0x2320524*=0x1) returned 0x0 [0318.134] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587e258) returned 0x0 [0318.135] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.135] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.135] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.136] IUnknown:AddRef (This=0x587e258) returned 0x3 [0318.136] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.136] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.136] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587e25c) returned 0x0 [0318.136] IMarshal:GetUnmarshalClass (in: This=0x587e25c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.136] IUnknown:Release (This=0x587e25c) returned 0x3 [0318.136] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.136] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.136] IUnknown:QueryInterface (in: This=0x587e258, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.137] IUnknown:Release (This=0x587e258) returned 0x2 [0318.137] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.137] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.137] IUnknown:QueryInterface (in: This=0x587e258, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587e258) returned 0x0 [0318.137] IUnknown:AddRef (This=0x587e258) returned 0x4 [0318.137] IUnknown:Release (This=0x587e258) returned 0x3 [0318.137] IUnknown:Release (This=0x587e258) returned 0x2 [0318.137] CoTaskMemFree (pv=0x586b180) [0318.137] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.137] IUnknown:AddRef (This=0x587e258) returned 0x3 [0318.137] IWbemClassObject:Get (in: This=0x587e258, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.137] IWbemClassObject:Get (in: This=0x587e258, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.139] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0318.139] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0318.139] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.139] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.139] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.139] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.140] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0318.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.141] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3970) returned 0x0 [0318.141] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3970) returned 0x0 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.141] WbemDefPath:IUnknown:AddRef (This=0x6d3970) returned 0x3 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58a4530) returned 0x0 [0318.142] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a4530, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.142] WbemDefPath:IUnknown:Release (This=0x58a4530) returned 0x3 [0318.142] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.142] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.142] WbemDefPath:IUnknown:Release (This=0x6d3970) returned 0x2 [0318.142] WbemDefPath:IUnknown:Release (This=0x6d3970) returned 0x1 [0318.142] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.142] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3970, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3970) returned 0x0 [0318.142] WbemDefPath:IUnknown:AddRef (This=0x6d3970) returned 0x3 [0318.142] WbemDefPath:IUnknown:Release (This=0x6d3970) returned 0x2 [0318.142] WbemDefPath:IWbemPath:SetText (This=0x6d3970, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x0 [0318.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.143] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.143] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.143] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.143] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.143] IWbemClassObject:Get (in: This=0x587e258, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233441c*=0, plFlavor=0x2334420*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x233441c*=8, plFlavor=0x2334420*=0) returned 0x0 [0318.143] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0318.143] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0318.143] IWbemClassObject:Get (in: This=0x587e258, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233441c*=8, plFlavor=0x2334420*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x233441c*=8, plFlavor=0x2334420*=0) returned 0x0 [0318.143] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0318.144] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0318.144] CoTaskMemAlloc (cb=0x4) returned 0x586b250 [0318.144] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b250, puReturned=0x2320524 | out: apObjects=0x586b250*=0x587da60, puReturned=0x2320524*=0x1) returned 0x0 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587da60) returned 0x0 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.147] IUnknown:AddRef (This=0x587da60) returned 0x3 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.147] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587da64) returned 0x0 [0318.147] IMarshal:GetUnmarshalClass (in: This=0x587da64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.148] IUnknown:Release (This=0x587da64) returned 0x3 [0318.148] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.148] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.148] IUnknown:QueryInterface (in: This=0x587da60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.148] IUnknown:Release (This=0x587da60) returned 0x2 [0318.148] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.148] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.148] IUnknown:QueryInterface (in: This=0x587da60, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587da60) returned 0x0 [0318.148] IUnknown:AddRef (This=0x587da60) returned 0x4 [0318.148] IUnknown:Release (This=0x587da60) returned 0x3 [0318.148] IUnknown:Release (This=0x587da60) returned 0x2 [0318.148] CoTaskMemFree (pv=0x586b250) [0318.148] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.148] IUnknown:AddRef (This=0x587da60) returned 0x3 [0318.149] IWbemClassObject:Get (in: This=0x587da60, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.149] IWbemClassObject:Get (in: This=0x587da60, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.150] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0318.150] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0318.150] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.150] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.150] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.150] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.152] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b240) returned 0x0 [0318.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b240, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.153] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b240, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3b30) returned 0x0 [0318.153] WbemDefPath:IUnknown:Release (This=0x586b240) returned 0x0 [0318.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3b30) returned 0x0 [0318.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.153] WbemDefPath:IUnknown:AddRef (This=0x6d3b30) returned 0x3 [0318.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5058) returned 0x0 [0318.154] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5058, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.154] WbemDefPath:IUnknown:Release (This=0x58b5058) returned 0x3 [0318.154] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.154] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.154] WbemDefPath:IUnknown:Release (This=0x6d3b30) returned 0x2 [0318.154] WbemDefPath:IUnknown:Release (This=0x6d3b30) returned 0x1 [0318.154] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.154] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3b30, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3b30) returned 0x0 [0318.155] WbemDefPath:IUnknown:AddRef (This=0x6d3b30) returned 0x3 [0318.155] WbemDefPath:IUnknown:Release (This=0x6d3b30) returned 0x2 [0318.155] WbemDefPath:IWbemPath:SetText (This=0x6d3b30, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.155] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.155] IWbemClassObject:Get (in: This=0x587da60, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334cb0*=0, plFlavor=0x2334cb4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x2334cb0*=8, plFlavor=0x2334cb4*=0) returned 0x0 [0318.155] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0318.156] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0318.156] IWbemClassObject:Get (in: This=0x587da60, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2334cb0*=8, plFlavor=0x2334cb4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x2334cb0*=8, plFlavor=0x2334cb4*=0) returned 0x0 [0318.156] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0318.156] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0318.156] CoTaskMemAlloc (cb=0x4) returned 0x586b110 [0318.156] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b110, puReturned=0x2320524 | out: apObjects=0x586b110*=0x587df28, puReturned=0x2320524*=0x1) returned 0x0 [0318.159] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587df28) returned 0x0 [0318.159] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.159] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.160] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.160] IUnknown:AddRef (This=0x587df28) returned 0x3 [0318.160] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.160] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.160] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587df2c) returned 0x0 [0318.160] IMarshal:GetUnmarshalClass (in: This=0x587df2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.160] IUnknown:Release (This=0x587df2c) returned 0x3 [0318.160] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.160] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.160] IUnknown:QueryInterface (in: This=0x587df28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.161] IUnknown:Release (This=0x587df28) returned 0x2 [0318.161] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.161] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.161] IUnknown:QueryInterface (in: This=0x587df28, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587df28) returned 0x0 [0318.161] IUnknown:AddRef (This=0x587df28) returned 0x4 [0318.161] IUnknown:Release (This=0x587df28) returned 0x3 [0318.161] IUnknown:Release (This=0x587df28) returned 0x2 [0318.161] CoTaskMemFree (pv=0x586b110) [0318.161] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.161] IUnknown:AddRef (This=0x587df28) returned 0x3 [0318.161] IWbemClassObject:Get (in: This=0x587df28, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.162] IWbemClassObject:Get (in: This=0x587df28, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.162] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0318.162] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0318.162] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.162] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.162] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.162] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.164] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0318.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.164] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3ba0) returned 0x0 [0318.164] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0318.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3ba0) returned 0x0 [0318.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.165] WbemDefPath:IUnknown:AddRef (This=0x6d3ba0) returned 0x3 [0318.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5208) returned 0x0 [0318.165] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5208, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.165] WbemDefPath:IUnknown:Release (This=0x58b5208) returned 0x3 [0318.165] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.166] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.166] WbemDefPath:IUnknown:Release (This=0x6d3ba0) returned 0x2 [0318.166] WbemDefPath:IUnknown:Release (This=0x6d3ba0) returned 0x1 [0318.166] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.166] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.166] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3ba0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3ba0) returned 0x0 [0318.166] WbemDefPath:IUnknown:AddRef (This=0x6d3ba0) returned 0x3 [0318.166] WbemDefPath:IUnknown:Release (This=0x6d3ba0) returned 0x2 [0318.166] WbemDefPath:IWbemPath:SetText (This=0x6d3ba0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x0 [0318.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.235] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.235] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.235] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.235] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.235] IWbemClassObject:Get (in: This=0x587df28, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335544*=0, plFlavor=0x2335548*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x2335544*=8, plFlavor=0x2335548*=0) returned 0x0 [0318.235] SysStringByteLen (bstr="fling.exe") returned 0x12 [0318.235] SysStringByteLen (bstr="fling.exe") returned 0x12 [0318.236] IWbemClassObject:Get (in: This=0x587df28, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335544*=8, plFlavor=0x2335548*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x2335544*=8, plFlavor=0x2335548*=0) returned 0x0 [0318.236] SysStringByteLen (bstr="fling.exe") returned 0x12 [0318.236] SysStringByteLen (bstr="fling.exe") returned 0x12 [0318.236] CoTaskMemAlloc (cb=0x4) returned 0x586b130 [0318.236] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b130, puReturned=0x2320524 | out: apObjects=0x586b130*=0x587e0c0, puReturned=0x2320524*=0x1) returned 0x0 [0318.238] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587e0c0) returned 0x0 [0318.238] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0318.238] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0318.238] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0318.239] IUnknown:AddRef (This=0x587e0c0) returned 0x3 [0318.239] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0318.239] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0318.239] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587e0c4) returned 0x0 [0318.239] IMarshal:GetUnmarshalClass (in: This=0x587e0c4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0318.239] IUnknown:Release (This=0x587e0c4) returned 0x3 [0318.239] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0318.240] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0318.240] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0318.240] IUnknown:Release (This=0x587e0c0) returned 0x2 [0318.240] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0318.240] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0318.240] IUnknown:QueryInterface (in: This=0x587e0c0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587e0c0) returned 0x0 [0318.240] IUnknown:AddRef (This=0x587e0c0) returned 0x4 [0318.240] IUnknown:Release (This=0x587e0c0) returned 0x3 [0318.240] IUnknown:Release (This=0x587e0c0) returned 0x2 [0318.240] CoTaskMemFree (pv=0x586b130) [0318.240] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0318.240] IUnknown:AddRef (This=0x587e0c0) returned 0x3 [0318.241] IWbemClassObject:Get (in: This=0x587e0c0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0318.241] IWbemClassObject:Get (in: This=0x587e0c0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0318.241] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0318.241] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0318.241] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0318.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0318.242] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0318.242] IUnknown:Release (This=0x692bc4) returned 0x1 [0318.243] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1f0) returned 0x0 [0318.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1f0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0318.243] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1f0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3d60) returned 0x0 [0318.243] WbemDefPath:IUnknown:Release (This=0x586b1f0) returned 0x0 [0318.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3d60) returned 0x0 [0318.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0318.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0318.244] WbemDefPath:IUnknown:AddRef (This=0x6d3d60) returned 0x3 [0318.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0318.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0318.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5448) returned 0x0 [0318.244] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5448, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0318.244] WbemDefPath:IUnknown:Release (This=0x58b5448) returned 0x3 [0318.244] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0318.259] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0318.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0318.259] WbemDefPath:IUnknown:Release (This=0x6d3d60) returned 0x2 [0318.259] WbemDefPath:IUnknown:Release (This=0x6d3d60) returned 0x1 [0318.259] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0318.259] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0318.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3d60, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3d60) returned 0x0 [0318.259] WbemDefPath:IUnknown:AddRef (This=0x6d3d60) returned 0x3 [0318.259] WbemDefPath:IUnknown:Release (This=0x6d3d60) returned 0x2 [0318.259] WbemDefPath:IWbemPath:SetText (This=0x6d3d60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0318.260] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0318.260] IWbemClassObject:Get (in: This=0x587e0c0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335dc8*=0, plFlavor=0x2335dcc*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2335dc8*=8, plFlavor=0x2335dcc*=0) returned 0x0 [0318.261] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0318.261] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0318.261] IWbemClassObject:Get (in: This=0x587e0c0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2335dc8*=8, plFlavor=0x2335dcc*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2335dc8*=8, plFlavor=0x2335dcc*=0) returned 0x0 [0318.261] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0318.261] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0318.261] CoTaskMemAlloc (cb=0x4) returned 0x586b290 [0318.262] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b290, puReturned=0x2320524 | out: apObjects=0x586b290*=0x587d730, puReturned=0x2320524*=0x1) returned 0x0 [0320.390] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587d730) returned 0x0 [0320.390] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.390] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.390] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.391] IUnknown:AddRef (This=0x587d730) returned 0x3 [0320.391] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.391] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.391] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587d734) returned 0x0 [0320.391] IMarshal:GetUnmarshalClass (in: This=0x587d734, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.391] IUnknown:Release (This=0x587d734) returned 0x3 [0320.391] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.391] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.391] IUnknown:QueryInterface (in: This=0x587d730, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.392] IUnknown:Release (This=0x587d730) returned 0x2 [0320.392] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.392] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.392] IUnknown:QueryInterface (in: This=0x587d730, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587d730) returned 0x0 [0320.392] IUnknown:AddRef (This=0x587d730) returned 0x4 [0320.392] IUnknown:Release (This=0x587d730) returned 0x3 [0320.392] IUnknown:Release (This=0x587d730) returned 0x2 [0320.392] CoTaskMemFree (pv=0x586b290) [0320.392] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.392] IUnknown:AddRef (This=0x587d730) returned 0x3 [0320.392] IWbemClassObject:Get (in: This=0x587d730, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.393] IWbemClassObject:Get (in: This=0x587d730, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.393] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0320.393] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0320.393] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.393] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.393] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.393] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.395] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b130) returned 0x0 [0320.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b130, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.395] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b130, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d34a0) returned 0x0 [0320.395] WbemDefPath:IUnknown:Release (This=0x586b130) returned 0x0 [0320.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d34a0) returned 0x0 [0320.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.396] WbemDefPath:IUnknown:AddRef (This=0x6d34a0) returned 0x3 [0320.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b54f0) returned 0x0 [0320.396] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b54f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.396] WbemDefPath:IUnknown:Release (This=0x58b54f0) returned 0x3 [0320.396] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.396] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.396] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.396] WbemDefPath:IUnknown:Release (This=0x6d34a0) returned 0x2 [0320.396] WbemDefPath:IUnknown:Release (This=0x6d34a0) returned 0x1 [0320.396] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.396] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.397] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d34a0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d34a0) returned 0x0 [0320.397] WbemDefPath:IUnknown:AddRef (This=0x6d34a0) returned 0x3 [0320.397] WbemDefPath:IUnknown:Release (This=0x6d34a0) returned 0x2 [0320.397] WbemDefPath:IWbemPath:SetText (This=0x6d34a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.397] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.398] IWbemClassObject:Get (in: This=0x587d730, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23366f4*=0, plFlavor=0x23366f8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x23366f4*=8, plFlavor=0x23366f8*=0) returned 0x0 [0320.398] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0320.398] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0320.398] IWbemClassObject:Get (in: This=0x587d730, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23366f4*=8, plFlavor=0x23366f8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x23366f4*=8, plFlavor=0x23366f8*=0) returned 0x0 [0320.398] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0320.398] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0320.398] CoTaskMemAlloc (cb=0x4) returned 0x586b2b0 [0320.399] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b2b0, puReturned=0x2320524 | out: apObjects=0x586b2b0*=0x587e3f0, puReturned=0x2320524*=0x1) returned 0x0 [0320.402] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587e3f0) returned 0x0 [0320.402] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.402] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.402] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.403] IUnknown:AddRef (This=0x587e3f0) returned 0x3 [0320.403] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.403] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.404] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587e3f4) returned 0x0 [0320.404] IMarshal:GetUnmarshalClass (in: This=0x587e3f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.404] IUnknown:Release (This=0x587e3f4) returned 0x3 [0320.404] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.404] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.405] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.405] IUnknown:Release (This=0x587e3f0) returned 0x2 [0320.405] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.405] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.405] IUnknown:QueryInterface (in: This=0x587e3f0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587e3f0) returned 0x0 [0320.405] IUnknown:AddRef (This=0x587e3f0) returned 0x4 [0320.405] IUnknown:Release (This=0x587e3f0) returned 0x3 [0320.405] IUnknown:Release (This=0x587e3f0) returned 0x2 [0320.405] CoTaskMemFree (pv=0x586b2b0) [0320.405] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.405] IUnknown:AddRef (This=0x587e3f0) returned 0x3 [0320.406] IWbemClassObject:Get (in: This=0x587e3f0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.406] IWbemClassObject:Get (in: This=0x587e3f0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.406] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0320.406] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0320.406] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.406] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.407] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.407] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.408] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1c0) returned 0x0 [0320.408] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.408] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d4000) returned 0x0 [0320.409] WbemDefPath:IUnknown:Release (This=0x586b1c0) returned 0x0 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d4000) returned 0x0 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.409] WbemDefPath:IUnknown:AddRef (This=0x6d4000) returned 0x3 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.409] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5790) returned 0x0 [0320.410] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5790, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.410] WbemDefPath:IUnknown:Release (This=0x58b5790) returned 0x3 [0320.410] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.410] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.410] WbemDefPath:IUnknown:Release (This=0x6d4000) returned 0x2 [0320.410] WbemDefPath:IUnknown:Release (This=0x6d4000) returned 0x1 [0320.410] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.410] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d4000, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d4000) returned 0x0 [0320.411] WbemDefPath:IUnknown:AddRef (This=0x6d4000) returned 0x3 [0320.411] WbemDefPath:IUnknown:Release (This=0x6d4000) returned 0x2 [0320.411] WbemDefPath:IWbemPath:SetText (This=0x6d4000, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.411] IWbemClassObject:Get (in: This=0x587e3f0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336fa8*=0, plFlavor=0x2336fac*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x2336fa8*=8, plFlavor=0x2336fac*=0) returned 0x0 [0320.411] SysStringByteLen (bstr="icq.exe") returned 0xe [0320.411] SysStringByteLen (bstr="icq.exe") returned 0xe [0320.412] IWbemClassObject:Get (in: This=0x587e3f0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2336fa8*=8, plFlavor=0x2336fac*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x2336fa8*=8, plFlavor=0x2336fac*=0) returned 0x0 [0320.412] SysStringByteLen (bstr="icq.exe") returned 0xe [0320.412] SysStringByteLen (bstr="icq.exe") returned 0xe [0320.412] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0320.412] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x587dbf8, puReturned=0x2320524*=0x1) returned 0x0 [0320.471] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587dbf8) returned 0x0 [0320.471] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.471] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.471] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.472] IUnknown:AddRef (This=0x587dbf8) returned 0x3 [0320.472] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.472] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.472] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587dbfc) returned 0x0 [0320.472] IMarshal:GetUnmarshalClass (in: This=0x587dbfc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.472] IUnknown:Release (This=0x587dbfc) returned 0x3 [0320.472] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.472] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.472] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.472] IUnknown:Release (This=0x587dbf8) returned 0x2 [0320.472] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.472] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.472] IUnknown:QueryInterface (in: This=0x587dbf8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587dbf8) returned 0x0 [0320.473] IUnknown:AddRef (This=0x587dbf8) returned 0x4 [0320.473] IUnknown:Release (This=0x587dbf8) returned 0x3 [0320.473] IUnknown:Release (This=0x587dbf8) returned 0x2 [0320.473] CoTaskMemFree (pv=0x586b1c0) [0320.473] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.473] IUnknown:AddRef (This=0x587dbf8) returned 0x3 [0320.473] IWbemClassObject:Get (in: This=0x587dbf8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.473] IWbemClassObject:Get (in: This=0x587dbf8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.474] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0320.475] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0320.475] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.475] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.475] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.475] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.477] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0320.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.477] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3510) returned 0x0 [0320.477] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0320.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3510) returned 0x0 [0320.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.478] WbemDefPath:IUnknown:AddRef (This=0x6d3510) returned 0x3 [0320.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5808) returned 0x0 [0320.478] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5808, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.478] WbemDefPath:IUnknown:Release (This=0x58b5808) returned 0x3 [0320.478] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.478] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.479] WbemDefPath:IUnknown:Release (This=0x6d3510) returned 0x2 [0320.479] WbemDefPath:IUnknown:Release (This=0x6d3510) returned 0x1 [0320.479] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.479] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3510, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3510) returned 0x0 [0320.479] WbemDefPath:IUnknown:AddRef (This=0x6d3510) returned 0x3 [0320.479] WbemDefPath:IUnknown:Release (This=0x6d3510) returned 0x2 [0320.479] WbemDefPath:IWbemPath:SetText (This=0x6d3510, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x0 [0320.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.480] IWbemClassObject:Get (in: This=0x587dbf8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337824*=0, plFlavor=0x2337828*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x2337824*=8, plFlavor=0x2337828*=0) returned 0x0 [0320.480] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0320.480] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0320.480] IWbemClassObject:Get (in: This=0x587dbf8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2337824*=8, plFlavor=0x2337828*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x2337824*=8, plFlavor=0x2337828*=0) returned 0x0 [0320.480] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0320.480] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0320.480] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0320.481] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x587d8c8, puReturned=0x2320524*=0x1) returned 0x0 [0320.486] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587d8c8) returned 0x0 [0320.486] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.486] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.486] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.487] IUnknown:AddRef (This=0x587d8c8) returned 0x3 [0320.487] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.487] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.487] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587d8cc) returned 0x0 [0320.487] IMarshal:GetUnmarshalClass (in: This=0x587d8cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.487] IUnknown:Release (This=0x587d8cc) returned 0x3 [0320.487] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.487] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.487] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.488] IUnknown:Release (This=0x587d8c8) returned 0x2 [0320.488] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.488] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.488] IUnknown:QueryInterface (in: This=0x587d8c8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587d8c8) returned 0x0 [0320.488] IUnknown:AddRef (This=0x587d8c8) returned 0x4 [0320.488] IUnknown:Release (This=0x587d8c8) returned 0x3 [0320.488] IUnknown:Release (This=0x587d8c8) returned 0x2 [0320.488] CoTaskMemFree (pv=0x586b1c0) [0320.488] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.488] IUnknown:AddRef (This=0x587d8c8) returned 0x3 [0320.488] IWbemClassObject:Get (in: This=0x587d8c8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.489] IWbemClassObject:Get (in: This=0x587d8c8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.489] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0320.489] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0320.489] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.489] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.489] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.489] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.491] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1f0) returned 0x0 [0320.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1f0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1f0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d3e40) returned 0x0 [0320.491] WbemDefPath:IUnknown:Release (This=0x586b1f0) returned 0x0 [0320.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d3e40) returned 0x0 [0320.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.492] WbemDefPath:IUnknown:AddRef (This=0x6d3e40) returned 0x3 [0320.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b5910) returned 0x0 [0320.492] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b5910, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.492] WbemDefPath:IUnknown:Release (This=0x58b5910) returned 0x3 [0320.492] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.493] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.493] WbemDefPath:IUnknown:Release (This=0x6d3e40) returned 0x2 [0320.493] WbemDefPath:IUnknown:Release (This=0x6d3e40) returned 0x1 [0320.493] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.493] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d3e40, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d3e40) returned 0x0 [0320.493] WbemDefPath:IUnknown:AddRef (This=0x6d3e40) returned 0x3 [0320.493] WbemDefPath:IUnknown:Release (This=0x6d3e40) returned 0x2 [0320.493] WbemDefPath:IWbemPath:SetText (This=0x6d3e40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.494] IWbemClassObject:Get (in: This=0x587d8c8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23380b8*=0, plFlavor=0x23380bc*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x23380b8*=8, plFlavor=0x23380bc*=0) returned 0x0 [0320.494] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0320.494] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0320.495] IWbemClassObject:Get (in: This=0x587d8c8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23380b8*=8, plFlavor=0x23380bc*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x23380b8*=8, plFlavor=0x23380bc*=0) returned 0x0 [0320.495] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0320.495] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0320.495] CoTaskMemAlloc (cb=0x4) returned 0x586b180 [0320.495] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b180, puReturned=0x2320524 | out: apObjects=0x586b180*=0x587dd90, puReturned=0x2320524*=0x1) returned 0x0 [0320.497] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x587dd90) returned 0x0 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.498] IUnknown:AddRef (This=0x587dd90) returned 0x3 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.498] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x587dd94) returned 0x0 [0320.499] IMarshal:GetUnmarshalClass (in: This=0x587dd94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.499] IUnknown:Release (This=0x587dd94) returned 0x3 [0320.499] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.499] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.499] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.499] IUnknown:Release (This=0x587dd90) returned 0x2 [0320.499] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.499] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.499] IUnknown:QueryInterface (in: This=0x587dd90, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x587dd90) returned 0x0 [0320.500] IUnknown:AddRef (This=0x587dd90) returned 0x4 [0320.500] IUnknown:Release (This=0x587dd90) returned 0x3 [0320.500] IUnknown:Release (This=0x587dd90) returned 0x2 [0320.500] CoTaskMemFree (pv=0x586b180) [0320.500] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.500] IUnknown:AddRef (This=0x587dd90) returned 0x3 [0320.500] IWbemClassObject:Get (in: This=0x587dd90, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.500] IWbemClassObject:Get (in: This=0x587dd90, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.500] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0320.501] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0320.501] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.501] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.501] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.501] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.503] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b1c0) returned 0x0 [0320.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b1c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.503] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b1c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6d35f0) returned 0x0 [0320.503] WbemDefPath:IUnknown:Release (This=0x586b1c0) returned 0x0 [0320.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6d35f0) returned 0x0 [0320.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.504] WbemDefPath:IUnknown:AddRef (This=0x6d35f0) returned 0x3 [0320.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b3ba0) returned 0x0 [0320.504] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b3ba0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.504] WbemDefPath:IUnknown:Release (This=0x58b3ba0) returned 0x3 [0320.504] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.505] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.505] WbemDefPath:IUnknown:Release (This=0x6d35f0) returned 0x2 [0320.505] WbemDefPath:IUnknown:Release (This=0x6d35f0) returned 0x1 [0320.505] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.505] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x6d35f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6d35f0) returned 0x0 [0320.506] WbemDefPath:IUnknown:AddRef (This=0x6d35f0) returned 0x3 [0320.506] WbemDefPath:IUnknown:Release (This=0x6d35f0) returned 0x2 [0320.506] WbemDefPath:IWbemPath:SetText (This=0x6d35f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.506] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.506] IWbemClassObject:Get (in: This=0x587dd90, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233893c*=0, plFlavor=0x2338940*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x233893c*=8, plFlavor=0x2338940*=0) returned 0x0 [0320.506] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0320.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0320.507] IWbemClassObject:Get (in: This=0x587dd90, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233893c*=8, plFlavor=0x2338940*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x233893c*=8, plFlavor=0x2338940*=0) returned 0x0 [0320.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0320.507] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0320.507] CoTaskMemAlloc (cb=0x4) returned 0x586b250 [0320.507] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b250, puReturned=0x2320524 | out: apObjects=0x586b250*=0x58ba108, puReturned=0x2320524*=0x1) returned 0x0 [0320.553] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba108) returned 0x0 [0320.553] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.553] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.553] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.554] IUnknown:AddRef (This=0x58ba108) returned 0x3 [0320.554] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.554] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.554] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba10c) returned 0x0 [0320.554] IMarshal:GetUnmarshalClass (in: This=0x58ba10c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.554] IUnknown:Release (This=0x58ba10c) returned 0x3 [0320.554] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.554] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.554] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.555] IUnknown:Release (This=0x58ba108) returned 0x2 [0320.555] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.555] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.555] IUnknown:QueryInterface (in: This=0x58ba108, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba108) returned 0x0 [0320.555] IUnknown:AddRef (This=0x58ba108) returned 0x4 [0320.555] IUnknown:Release (This=0x58ba108) returned 0x3 [0320.555] IUnknown:Release (This=0x58ba108) returned 0x2 [0320.555] CoTaskMemFree (pv=0x586b250) [0320.555] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.555] IUnknown:AddRef (This=0x58ba108) returned 0x3 [0320.555] IWbemClassObject:Get (in: This=0x58ba108, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.556] IWbemClassObject:Get (in: This=0x58ba108, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.557] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0320.557] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0320.557] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.557] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.557] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.557] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.559] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b170) returned 0x0 [0320.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b170, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b170, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0960) returned 0x0 [0320.560] WbemDefPath:IUnknown:Release (This=0x586b170) returned 0x0 [0320.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0960) returned 0x0 [0320.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.561] WbemDefPath:IUnknown:AddRef (This=0x6e0960) returned 0x3 [0320.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b3ca8) returned 0x0 [0320.561] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b3ca8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.561] WbemDefPath:IUnknown:Release (This=0x58b3ca8) returned 0x3 [0320.561] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.561] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.561] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.562] WbemDefPath:IUnknown:Release (This=0x6e0960) returned 0x2 [0320.562] WbemDefPath:IUnknown:Release (This=0x6e0960) returned 0x1 [0320.562] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.562] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.562] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0960, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0960) returned 0x0 [0320.562] WbemDefPath:IUnknown:AddRef (This=0x6e0960) returned 0x3 [0320.562] WbemDefPath:IUnknown:Release (This=0x6e0960) returned 0x2 [0320.562] WbemDefPath:IWbemPath:SetText (This=0x6e0960, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x0 [0320.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.562] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.562] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.562] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.563] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.563] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.563] IWbemClassObject:Get (in: This=0x58ba108, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23391c8*=0, plFlavor=0x23391cc*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x23391c8*=8, plFlavor=0x23391cc*=0) returned 0x0 [0320.563] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0320.563] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0320.563] IWbemClassObject:Get (in: This=0x58ba108, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23391c8*=8, plFlavor=0x23391cc*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x23391c8*=8, plFlavor=0x23391cc*=0) returned 0x0 [0320.563] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0320.563] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0320.564] CoTaskMemAlloc (cb=0x4) returned 0x586b250 [0320.564] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b250, puReturned=0x2320524 | out: apObjects=0x586b250*=0x58ba2a0, puReturned=0x2320524*=0x1) returned 0x0 [0320.566] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba2a0) returned 0x0 [0320.566] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.566] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.566] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.566] IUnknown:AddRef (This=0x58ba2a0) returned 0x3 [0320.566] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.567] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.567] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba2a4) returned 0x0 [0320.567] IMarshal:GetUnmarshalClass (in: This=0x58ba2a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.567] IUnknown:Release (This=0x58ba2a4) returned 0x3 [0320.567] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.567] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.567] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.567] IUnknown:Release (This=0x58ba2a0) returned 0x2 [0320.567] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.568] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.568] IUnknown:QueryInterface (in: This=0x58ba2a0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba2a0) returned 0x0 [0320.568] IUnknown:AddRef (This=0x58ba2a0) returned 0x4 [0320.568] IUnknown:Release (This=0x58ba2a0) returned 0x3 [0320.568] IUnknown:Release (This=0x58ba2a0) returned 0x2 [0320.568] CoTaskMemFree (pv=0x586b250) [0320.568] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.568] IUnknown:AddRef (This=0x58ba2a0) returned 0x3 [0320.568] IWbemClassObject:Get (in: This=0x58ba2a0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.569] IWbemClassObject:Get (in: This=0x58ba2a0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.569] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0320.569] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0320.569] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.569] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.569] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.569] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.571] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b170) returned 0x0 [0320.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b170, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.571] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b170, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e08f0) returned 0x0 [0320.571] WbemDefPath:IUnknown:Release (This=0x586b170) returned 0x0 [0320.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e08f0) returned 0x0 [0320.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.572] WbemDefPath:IUnknown:AddRef (This=0x6e08f0) returned 0x3 [0320.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.572] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b3f00) returned 0x0 [0320.572] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b3f00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.572] WbemDefPath:IUnknown:Release (This=0x58b3f00) returned 0x3 [0320.572] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.572] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.573] WbemDefPath:IUnknown:Release (This=0x6e08f0) returned 0x2 [0320.573] WbemDefPath:IUnknown:Release (This=0x6e08f0) returned 0x1 [0320.573] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.573] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e08f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e08f0) returned 0x0 [0320.573] WbemDefPath:IUnknown:AddRef (This=0x6e08f0) returned 0x3 [0320.573] WbemDefPath:IUnknown:Release (This=0x6e08f0) returned 0x2 [0320.573] WbemDefPath:IWbemPath:SetText (This=0x6e08f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x0 [0320.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.573] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.573] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.574] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.574] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.574] IWbemClassObject:Get (in: This=0x58ba2a0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2339a5c*=0, plFlavor=0x2339a60*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x2339a5c*=8, plFlavor=0x2339a60*=0) returned 0x0 [0320.574] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0320.574] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0320.574] IWbemClassObject:Get (in: This=0x58ba2a0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2339a5c*=8, plFlavor=0x2339a60*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x2339a5c*=8, plFlavor=0x2339a60*=0) returned 0x0 [0320.575] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0320.575] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0320.602] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0320.602] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x58baa98, puReturned=0x2320524*=0x1) returned 0x0 [0320.645] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58baa98) returned 0x0 [0320.646] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.646] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.646] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.646] IUnknown:AddRef (This=0x58baa98) returned 0x3 [0320.647] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.647] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.647] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58baa9c) returned 0x0 [0320.647] IMarshal:GetUnmarshalClass (in: This=0x58baa9c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.647] IUnknown:Release (This=0x58baa9c) returned 0x3 [0320.647] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.647] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.647] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.648] IUnknown:Release (This=0x58baa98) returned 0x2 [0320.648] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.648] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.648] IUnknown:QueryInterface (in: This=0x58baa98, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58baa98) returned 0x0 [0320.648] IUnknown:AddRef (This=0x58baa98) returned 0x4 [0320.648] IUnknown:Release (This=0x58baa98) returned 0x3 [0320.648] IUnknown:Release (This=0x58baa98) returned 0x2 [0320.648] CoTaskMemFree (pv=0x586b170) [0320.648] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.648] IUnknown:AddRef (This=0x58baa98) returned 0x3 [0320.648] IWbemClassObject:Get (in: This=0x58baa98, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.649] IWbemClassObject:Get (in: This=0x58baa98, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.649] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0320.649] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0320.649] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.649] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.650] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.650] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.651] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b270) returned 0x0 [0320.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b270, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.651] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b270, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e01f0) returned 0x0 [0320.652] WbemDefPath:IUnknown:Release (This=0x586b270) returned 0x0 [0320.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e01f0) returned 0x0 [0320.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.652] WbemDefPath:IUnknown:AddRef (This=0x6e01f0) returned 0x3 [0320.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.653] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b42a8) returned 0x0 [0320.653] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b42a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.653] WbemDefPath:IUnknown:Release (This=0x58b42a8) returned 0x3 [0320.654] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.654] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.654] WbemDefPath:IUnknown:Release (This=0x6e01f0) returned 0x2 [0320.654] WbemDefPath:IUnknown:Release (This=0x6e01f0) returned 0x1 [0320.654] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.654] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e01f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e01f0) returned 0x0 [0320.655] WbemDefPath:IUnknown:AddRef (This=0x6e01f0) returned 0x3 [0320.655] WbemDefPath:IUnknown:Release (This=0x6e01f0) returned 0x2 [0320.655] WbemDefPath:IWbemPath:SetText (This=0x6e01f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.655] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.655] IWbemClassObject:Get (in: This=0x58baa98, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233a2e8*=0, plFlavor=0x233a2ec*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x233a2e8*=8, plFlavor=0x233a2ec*=0) returned 0x0 [0320.656] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0320.656] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0320.656] IWbemClassObject:Get (in: This=0x58baa98, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233a2e8*=8, plFlavor=0x233a2ec*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x233a2e8*=8, plFlavor=0x233a2ec*=0) returned 0x0 [0320.656] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0320.656] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0320.656] CoTaskMemAlloc (cb=0x4) returned 0x586b140 [0320.656] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b140, puReturned=0x2320524 | out: apObjects=0x586b140*=0x58bbdb8, puReturned=0x2320524*=0x1) returned 0x0 [0320.658] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bbdb8) returned 0x0 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.659] IUnknown:AddRef (This=0x58bbdb8) returned 0x3 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.659] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bbdbc) returned 0x0 [0320.659] IMarshal:GetUnmarshalClass (in: This=0x58bbdbc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.659] IUnknown:Release (This=0x58bbdbc) returned 0x3 [0320.660] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.660] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.660] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.660] IUnknown:Release (This=0x58bbdb8) returned 0x2 [0320.660] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.660] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.660] IUnknown:QueryInterface (in: This=0x58bbdb8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bbdb8) returned 0x0 [0320.660] IUnknown:AddRef (This=0x58bbdb8) returned 0x4 [0320.660] IUnknown:Release (This=0x58bbdb8) returned 0x3 [0320.660] IUnknown:Release (This=0x58bbdb8) returned 0x2 [0320.661] CoTaskMemFree (pv=0x586b140) [0320.661] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.661] IUnknown:AddRef (This=0x58bbdb8) returned 0x3 [0320.661] IWbemClassObject:Get (in: This=0x58bbdb8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.661] IWbemClassObject:Get (in: This=0x58bbdb8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.661] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0320.661] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0320.662] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.662] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.662] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.662] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.664] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b140) returned 0x0 [0320.664] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b140, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.664] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b140, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0810) returned 0x0 [0320.664] WbemDefPath:IUnknown:Release (This=0x586b140) returned 0x0 [0320.664] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0810) returned 0x0 [0320.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.665] WbemDefPath:IUnknown:AddRef (This=0x6e0810) returned 0x3 [0320.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.665] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b4170) returned 0x0 [0320.665] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b4170, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.665] WbemDefPath:IUnknown:Release (This=0x58b4170) returned 0x3 [0320.665] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.666] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.666] WbemDefPath:IUnknown:Release (This=0x6e0810) returned 0x2 [0320.666] WbemDefPath:IUnknown:Release (This=0x6e0810) returned 0x1 [0320.666] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.666] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0810, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0810) returned 0x0 [0320.666] WbemDefPath:IUnknown:AddRef (This=0x6e0810) returned 0x3 [0320.666] WbemDefPath:IUnknown:Release (This=0x6e0810) returned 0x2 [0320.666] WbemDefPath:IWbemPath:SetText (This=0x6e0810, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.667] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.667] IWbemClassObject:Get (in: This=0x58bbdb8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233ab74*=0, plFlavor=0x233ab78*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x233ab74*=8, plFlavor=0x233ab78*=0) returned 0x0 [0320.667] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0320.667] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0320.668] IWbemClassObject:Get (in: This=0x58bbdb8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233ab74*=8, plFlavor=0x233ab78*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x233ab74*=8, plFlavor=0x233ab78*=0) returned 0x0 [0320.668] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0320.668] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0320.670] CoTaskMemAlloc (cb=0x4) returned 0x586b270 [0320.670] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b270, puReturned=0x2320524 | out: apObjects=0x586b270*=0x58bb758, puReturned=0x2320524*=0x1) returned 0x0 [0320.674] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb758) returned 0x0 [0320.674] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.674] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.675] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.675] IUnknown:AddRef (This=0x58bb758) returned 0x3 [0320.675] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.675] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.675] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb75c) returned 0x0 [0320.675] IMarshal:GetUnmarshalClass (in: This=0x58bb75c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.675] IUnknown:Release (This=0x58bb75c) returned 0x3 [0320.675] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.676] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.676] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.676] IUnknown:Release (This=0x58bb758) returned 0x2 [0320.676] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.676] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.676] IUnknown:QueryInterface (in: This=0x58bb758, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb758) returned 0x0 [0320.676] IUnknown:AddRef (This=0x58bb758) returned 0x4 [0320.676] IUnknown:Release (This=0x58bb758) returned 0x3 [0320.676] IUnknown:Release (This=0x58bb758) returned 0x2 [0320.676] CoTaskMemFree (pv=0x586b270) [0320.676] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.677] IUnknown:AddRef (This=0x58bb758) returned 0x3 [0320.677] IWbemClassObject:Get (in: This=0x58bb758, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.677] IWbemClassObject:Get (in: This=0x58bb758, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0320.678] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0320.678] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.678] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.679] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.679] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.680] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b250) returned 0x0 [0320.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b250, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.680] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b250, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0490) returned 0x0 [0320.680] WbemDefPath:IUnknown:Release (This=0x586b250) returned 0x0 [0320.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0490) returned 0x0 [0320.680] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.681] WbemDefPath:IUnknown:AddRef (This=0x6e0490) returned 0x3 [0320.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b45f0) returned 0x0 [0320.681] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b45f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.681] WbemDefPath:IUnknown:Release (This=0x58b45f0) returned 0x3 [0320.681] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.681] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.681] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.681] WbemDefPath:IUnknown:Release (This=0x6e0490) returned 0x2 [0320.682] WbemDefPath:IUnknown:Release (This=0x6e0490) returned 0x1 [0320.682] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.682] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.682] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0490, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0490) returned 0x0 [0320.682] WbemDefPath:IUnknown:AddRef (This=0x6e0490) returned 0x3 [0320.682] WbemDefPath:IUnknown:Release (This=0x6e0490) returned 0x2 [0320.682] WbemDefPath:IWbemPath:SetText (This=0x6e0490, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.682] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.682] IWbemClassObject:Get (in: This=0x58bb758, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233b408*=0, plFlavor=0x233b40c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x233b408*=8, plFlavor=0x233b40c*=0) returned 0x0 [0320.683] SysStringByteLen (bstr="skype.exe") returned 0x12 [0320.683] SysStringByteLen (bstr="skype.exe") returned 0x12 [0320.683] IWbemClassObject:Get (in: This=0x58bb758, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233b408*=8, plFlavor=0x233b40c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x233b408*=8, plFlavor=0x233b40c*=0) returned 0x0 [0320.683] SysStringByteLen (bstr="skype.exe") returned 0x12 [0320.683] SysStringByteLen (bstr="skype.exe") returned 0x12 [0320.683] CoTaskMemAlloc (cb=0x4) returned 0x586b2b0 [0320.683] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b2b0, puReturned=0x2320524 | out: apObjects=0x586b2b0*=0x58baf60, puReturned=0x2320524*=0x1) returned 0x0 [0320.739] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58baf60) returned 0x0 [0320.740] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.740] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.740] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.740] IUnknown:AddRef (This=0x58baf60) returned 0x3 [0320.740] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.741] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.741] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58baf64) returned 0x0 [0320.741] IMarshal:GetUnmarshalClass (in: This=0x58baf64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.741] IUnknown:Release (This=0x58baf64) returned 0x3 [0320.741] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.741] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.741] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.741] IUnknown:Release (This=0x58baf60) returned 0x2 [0320.741] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.741] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.742] IUnknown:QueryInterface (in: This=0x58baf60, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58baf60) returned 0x0 [0320.742] IUnknown:AddRef (This=0x58baf60) returned 0x4 [0320.742] IUnknown:Release (This=0x58baf60) returned 0x3 [0320.742] IUnknown:Release (This=0x58baf60) returned 0x2 [0320.742] CoTaskMemFree (pv=0x586b2b0) [0320.742] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.742] IUnknown:AddRef (This=0x58baf60) returned 0x3 [0320.742] IWbemClassObject:Get (in: This=0x58baf60, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.742] IWbemClassObject:Get (in: This=0x58baf60, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.743] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0320.743] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0320.743] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.743] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.743] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.743] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.745] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0320.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.745] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e06c0) returned 0x0 [0320.745] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0320.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e06c0) returned 0x0 [0320.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.746] WbemDefPath:IUnknown:AddRef (This=0x6e06c0) returned 0x3 [0320.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b4518) returned 0x0 [0320.746] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b4518, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.746] WbemDefPath:IUnknown:Release (This=0x58b4518) returned 0x3 [0320.746] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.747] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.747] WbemDefPath:IUnknown:Release (This=0x6e06c0) returned 0x2 [0320.747] WbemDefPath:IUnknown:Release (This=0x6e06c0) returned 0x1 [0320.747] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.747] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e06c0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e06c0) returned 0x0 [0320.748] WbemDefPath:IUnknown:AddRef (This=0x6e06c0) returned 0x3 [0320.748] WbemDefPath:IUnknown:Release (This=0x6e06c0) returned 0x2 [0320.748] WbemDefPath:IWbemPath:SetText (This=0x6e06c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.748] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.748] IWbemClassObject:Get (in: This=0x58baf60, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233bc8c*=0, plFlavor=0x233bc90*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x233bc8c*=8, plFlavor=0x233bc90*=0) returned 0x0 [0320.749] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0320.749] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0320.749] IWbemClassObject:Get (in: This=0x58baf60, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233bc8c*=8, plFlavor=0x233bc90*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x233bc8c*=8, plFlavor=0x233bc90*=0) returned 0x0 [0320.749] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0320.749] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0320.749] CoTaskMemAlloc (cb=0x4) returned 0x586b260 [0320.750] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b260, puReturned=0x2320524 | out: apObjects=0x586b260*=0x58bb428, puReturned=0x2320524*=0x1) returned 0x0 [0320.751] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb428) returned 0x0 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.752] IUnknown:AddRef (This=0x58bb428) returned 0x3 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.752] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb42c) returned 0x0 [0320.753] IMarshal:GetUnmarshalClass (in: This=0x58bb42c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.753] IUnknown:Release (This=0x58bb42c) returned 0x3 [0320.753] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.753] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.753] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.753] IUnknown:Release (This=0x58bb428) returned 0x2 [0320.753] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.753] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.754] IUnknown:QueryInterface (in: This=0x58bb428, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb428) returned 0x0 [0320.754] IUnknown:AddRef (This=0x58bb428) returned 0x4 [0320.754] IUnknown:Release (This=0x58bb428) returned 0x3 [0320.754] IUnknown:Release (This=0x58bb428) returned 0x2 [0320.754] CoTaskMemFree (pv=0x586b260) [0320.754] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.754] IUnknown:AddRef (This=0x58bb428) returned 0x3 [0320.754] IWbemClassObject:Get (in: This=0x58bb428, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.754] IWbemClassObject:Get (in: This=0x58bb428, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.755] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0320.755] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0320.755] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.755] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.755] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.755] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.757] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b160) returned 0x0 [0320.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b160, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.757] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b160, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0260) returned 0x0 [0320.757] WbemDefPath:IUnknown:Release (This=0x586b160) returned 0x0 [0320.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0260) returned 0x0 [0320.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.757] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.758] WbemDefPath:IUnknown:AddRef (This=0x6e0260) returned 0x3 [0320.758] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.758] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.758] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b46f8) returned 0x0 [0320.758] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b46f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.758] WbemDefPath:IUnknown:Release (This=0x58b46f8) returned 0x3 [0320.758] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.759] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.759] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.759] WbemDefPath:IUnknown:Release (This=0x6e0260) returned 0x2 [0320.759] WbemDefPath:IUnknown:Release (This=0x6e0260) returned 0x1 [0320.759] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.759] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.759] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0260, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0260) returned 0x0 [0320.759] WbemDefPath:IUnknown:AddRef (This=0x6e0260) returned 0x3 [0320.759] WbemDefPath:IUnknown:Release (This=0x6e0260) returned 0x2 [0320.759] WbemDefPath:IWbemPath:SetText (This=0x6e0260, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x0 [0320.759] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.760] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.760] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.760] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.760] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.760] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.760] IWbemClassObject:Get (in: This=0x58bb428, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233c520*=0, plFlavor=0x233c524*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x233c520*=8, plFlavor=0x233c524*=0) returned 0x0 [0320.760] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0320.761] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0320.761] IWbemClassObject:Get (in: This=0x58bb428, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233c520*=8, plFlavor=0x233c524*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x233c520*=8, plFlavor=0x233c524*=0) returned 0x0 [0320.761] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0320.761] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0320.761] CoTaskMemAlloc (cb=0x4) returned 0x586b120 [0320.761] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b120, puReturned=0x2320524 | out: apObjects=0x586b120*=0x58bac30, puReturned=0x2320524*=0x1) returned 0x0 [0320.765] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bac30) returned 0x0 [0320.765] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.765] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.765] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.765] IUnknown:AddRef (This=0x58bac30) returned 0x3 [0320.766] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.766] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.766] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bac34) returned 0x0 [0320.766] IMarshal:GetUnmarshalClass (in: This=0x58bac34, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.766] IUnknown:Release (This=0x58bac34) returned 0x3 [0320.766] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.766] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.766] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.767] IUnknown:Release (This=0x58bac30) returned 0x2 [0320.767] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.767] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.767] IUnknown:QueryInterface (in: This=0x58bac30, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bac30) returned 0x0 [0320.767] IUnknown:AddRef (This=0x58bac30) returned 0x4 [0320.767] IUnknown:Release (This=0x58bac30) returned 0x3 [0320.767] IUnknown:Release (This=0x58bac30) returned 0x2 [0320.767] CoTaskMemFree (pv=0x586b120) [0320.767] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.767] IUnknown:AddRef (This=0x58bac30) returned 0x3 [0320.767] IWbemClassObject:Get (in: This=0x58bac30, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.768] IWbemClassObject:Get (in: This=0x58bac30, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.768] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0320.768] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0320.768] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.768] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.768] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.768] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.770] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b270) returned 0x0 [0320.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b270, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.770] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b270, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0570) returned 0x0 [0320.770] WbemDefPath:IUnknown:Release (This=0x586b270) returned 0x0 [0320.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0570) returned 0x0 [0320.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.771] WbemDefPath:IUnknown:AddRef (This=0x6e0570) returned 0x3 [0320.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b48f0) returned 0x0 [0320.771] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b48f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.771] WbemDefPath:IUnknown:Release (This=0x58b48f0) returned 0x3 [0320.771] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.772] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.772] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.772] WbemDefPath:IUnknown:Release (This=0x6e0570) returned 0x2 [0320.772] WbemDefPath:IUnknown:Release (This=0x6e0570) returned 0x1 [0320.772] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.772] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.772] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0570, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0570) returned 0x0 [0320.772] WbemDefPath:IUnknown:AddRef (This=0x6e0570) returned 0x3 [0320.772] WbemDefPath:IUnknown:Release (This=0x6e0570) returned 0x2 [0320.772] WbemDefPath:IWbemPath:SetText (This=0x6e0570, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.773] IWbemClassObject:Get (in: This=0x58bac30, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233cdbc*=0, plFlavor=0x233cdc0*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x233cdbc*=8, plFlavor=0x233cdc0*=0) returned 0x0 [0320.773] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0320.773] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0320.774] IWbemClassObject:Get (in: This=0x58bac30, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233cdbc*=8, plFlavor=0x233cdc0*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x233cdbc*=8, plFlavor=0x233cdc0*=0) returned 0x0 [0320.774] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0320.774] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0320.774] CoTaskMemAlloc (cb=0x4) returned 0x586b1d0 [0320.774] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1d0, puReturned=0x2320524 | out: apObjects=0x586b1d0*=0x58badc8, puReturned=0x2320524*=0x1) returned 0x0 [0320.824] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58badc8) returned 0x0 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.825] IUnknown:AddRef (This=0x58badc8) returned 0x3 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.825] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58badcc) returned 0x0 [0320.826] IMarshal:GetUnmarshalClass (in: This=0x58badcc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.826] IUnknown:Release (This=0x58badcc) returned 0x3 [0320.826] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.826] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.826] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.826] IUnknown:Release (This=0x58badc8) returned 0x2 [0320.826] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.826] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.826] IUnknown:QueryInterface (in: This=0x58badc8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58badc8) returned 0x0 [0320.826] IUnknown:AddRef (This=0x58badc8) returned 0x4 [0320.827] IUnknown:Release (This=0x58badc8) returned 0x3 [0320.827] IUnknown:Release (This=0x58badc8) returned 0x2 [0320.827] CoTaskMemFree (pv=0x586b1d0) [0320.827] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.827] IUnknown:AddRef (This=0x58badc8) returned 0x3 [0320.827] IWbemClassObject:Get (in: This=0x58badc8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.827] IWbemClassObject:Get (in: This=0x58badc8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.827] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0320.828] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0320.828] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.828] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.828] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.828] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.830] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0320.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.830] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e02d0) returned 0x0 [0320.831] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e02d0) returned 0x0 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.831] WbemDefPath:IUnknown:AddRef (This=0x6e02d0) returned 0x3 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b4968) returned 0x0 [0320.832] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b4968, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.832] WbemDefPath:IUnknown:Release (This=0x58b4968) returned 0x3 [0320.832] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.832] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.832] WbemDefPath:IUnknown:Release (This=0x6e02d0) returned 0x2 [0320.832] WbemDefPath:IUnknown:Release (This=0x6e02d0) returned 0x1 [0320.832] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.832] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e02d0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e02d0) returned 0x0 [0320.832] WbemDefPath:IUnknown:AddRef (This=0x6e02d0) returned 0x3 [0320.832] WbemDefPath:IUnknown:Release (This=0x6e02d0) returned 0x2 [0320.833] WbemDefPath:IWbemPath:SetText (This=0x6e02d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.833] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.833] IWbemClassObject:Get (in: This=0x58badc8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233d650*=0, plFlavor=0x233d654*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x233d650*=8, plFlavor=0x233d654*=0) returned 0x0 [0320.833] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0320.833] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0320.833] IWbemClassObject:Get (in: This=0x58badc8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233d650*=8, plFlavor=0x233d654*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x233d650*=8, plFlavor=0x233d654*=0) returned 0x0 [0320.834] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0320.834] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0320.834] CoTaskMemAlloc (cb=0x4) returned 0x586b150 [0320.834] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b150, puReturned=0x2320524 | out: apObjects=0x586b150*=0x58ba768, puReturned=0x2320524*=0x1) returned 0x0 [0320.836] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba768) returned 0x0 [0320.836] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.836] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.836] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.836] IUnknown:AddRef (This=0x58ba768) returned 0x3 [0320.836] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.837] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.837] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba76c) returned 0x0 [0320.837] IMarshal:GetUnmarshalClass (in: This=0x58ba76c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.837] IUnknown:Release (This=0x58ba76c) returned 0x3 [0320.837] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.837] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.837] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.837] IUnknown:Release (This=0x58ba768) returned 0x2 [0320.837] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.837] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.837] IUnknown:QueryInterface (in: This=0x58ba768, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba768) returned 0x0 [0320.837] IUnknown:AddRef (This=0x58ba768) returned 0x4 [0320.838] IUnknown:Release (This=0x58ba768) returned 0x3 [0320.838] IUnknown:Release (This=0x58ba768) returned 0x2 [0320.838] CoTaskMemFree (pv=0x586b150) [0320.838] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.838] IUnknown:AddRef (This=0x58ba768) returned 0x3 [0320.838] IWbemClassObject:Get (in: This=0x58ba768, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.838] IWbemClassObject:Get (in: This=0x58ba768, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.838] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0320.838] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0320.839] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.839] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.839] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.839] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.841] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0320.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.841] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0730) returned 0x0 [0320.841] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0320.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0730) returned 0x0 [0320.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.842] WbemDefPath:IUnknown:AddRef (This=0x6e0730) returned 0x3 [0320.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b4ef0) returned 0x0 [0320.842] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b4ef0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.842] WbemDefPath:IUnknown:Release (This=0x58b4ef0) returned 0x3 [0320.842] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.842] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.843] WbemDefPath:IUnknown:Release (This=0x6e0730) returned 0x2 [0320.843] WbemDefPath:IUnknown:Release (This=0x6e0730) returned 0x1 [0320.843] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.843] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0730, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0730) returned 0x0 [0320.843] WbemDefPath:IUnknown:AddRef (This=0x6e0730) returned 0x3 [0320.843] WbemDefPath:IUnknown:Release (This=0x6e0730) returned 0x2 [0320.843] WbemDefPath:IWbemPath:SetText (This=0x6e0730, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x0 [0320.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.843] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.844] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.844] IWbemClassObject:Get (in: This=0x58ba768, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233dee4*=0, plFlavor=0x233dee8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x233dee4*=8, plFlavor=0x233dee8*=0) returned 0x0 [0320.844] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0320.844] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0320.844] IWbemClassObject:Get (in: This=0x58ba768, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233dee4*=8, plFlavor=0x233dee8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x233dee4*=8, plFlavor=0x233dee8*=0) returned 0x0 [0320.845] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0320.845] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0320.845] CoTaskMemAlloc (cb=0x4) returned 0x586b160 [0320.845] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b160, puReturned=0x2320524 | out: apObjects=0x586b160*=0x58ba438, puReturned=0x2320524*=0x1) returned 0x0 [0320.847] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba438) returned 0x0 [0320.847] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.847] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.847] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.847] IUnknown:AddRef (This=0x58ba438) returned 0x3 [0320.848] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.848] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.848] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba43c) returned 0x0 [0320.848] IMarshal:GetUnmarshalClass (in: This=0x58ba43c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.848] IUnknown:Release (This=0x58ba43c) returned 0x3 [0320.848] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.848] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.848] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.848] IUnknown:Release (This=0x58ba438) returned 0x2 [0320.848] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.849] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.849] IUnknown:QueryInterface (in: This=0x58ba438, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba438) returned 0x0 [0320.849] IUnknown:AddRef (This=0x58ba438) returned 0x4 [0320.849] IUnknown:Release (This=0x58ba438) returned 0x3 [0320.849] IUnknown:Release (This=0x58ba438) returned 0x2 [0320.849] CoTaskMemFree (pv=0x586b160) [0320.849] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.849] IUnknown:AddRef (This=0x58ba438) returned 0x3 [0320.849] IWbemClassObject:Get (in: This=0x58ba438, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.849] IWbemClassObject:Get (in: This=0x58ba438, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.850] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0320.851] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0320.851] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.851] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.851] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.851] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.852] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b130) returned 0x0 [0320.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b130, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b130, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0340) returned 0x0 [0320.853] WbemDefPath:IUnknown:Release (This=0x586b130) returned 0x0 [0320.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0340) returned 0x0 [0320.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.854] WbemDefPath:IUnknown:AddRef (This=0x6e0340) returned 0x3 [0320.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58b4de8) returned 0x0 [0320.854] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58b4de8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.854] WbemDefPath:IUnknown:Release (This=0x58b4de8) returned 0x3 [0320.854] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.854] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.854] WbemDefPath:IUnknown:Release (This=0x6e0340) returned 0x2 [0320.854] WbemDefPath:IUnknown:Release (This=0x6e0340) returned 0x1 [0320.855] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.855] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0340, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0340) returned 0x0 [0320.855] WbemDefPath:IUnknown:AddRef (This=0x6e0340) returned 0x3 [0320.855] WbemDefPath:IUnknown:Release (This=0x6e0340) returned 0x2 [0320.855] WbemDefPath:IWbemPath:SetText (This=0x6e0340, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.855] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.856] IWbemClassObject:Get (in: This=0x58ba438, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233e778*=0, plFlavor=0x233e77c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x233e778*=8, plFlavor=0x233e77c*=0) returned 0x0 [0320.856] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0320.856] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0320.856] IWbemClassObject:Get (in: This=0x58ba438, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233e778*=8, plFlavor=0x233e77c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x233e778*=8, plFlavor=0x233e77c*=0) returned 0x0 [0320.856] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0320.856] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0320.916] CoTaskMemAlloc (cb=0x4) returned 0x586b160 [0320.916] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b160, puReturned=0x2320524 | out: apObjects=0x586b160*=0x58bb0f8, puReturned=0x2320524*=0x1) returned 0x0 [0320.920] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb0f8) returned 0x0 [0320.920] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.920] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.920] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.921] IUnknown:AddRef (This=0x58bb0f8) returned 0x3 [0320.921] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.921] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.921] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb0fc) returned 0x0 [0320.921] IMarshal:GetUnmarshalClass (in: This=0x58bb0fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.921] IUnknown:Release (This=0x58bb0fc) returned 0x3 [0320.921] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.921] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.921] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.921] IUnknown:Release (This=0x58bb0f8) returned 0x2 [0320.922] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.922] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.922] IUnknown:QueryInterface (in: This=0x58bb0f8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb0f8) returned 0x0 [0320.922] IUnknown:AddRef (This=0x58bb0f8) returned 0x4 [0320.922] IUnknown:Release (This=0x58bb0f8) returned 0x3 [0320.922] IUnknown:Release (This=0x58bb0f8) returned 0x2 [0320.922] CoTaskMemFree (pv=0x586b160) [0320.922] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.922] IUnknown:AddRef (This=0x58bb0f8) returned 0x3 [0320.922] IWbemClassObject:Get (in: This=0x58bb0f8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.923] IWbemClassObject:Get (in: This=0x58bb0f8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.923] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0320.923] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0320.923] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.923] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.923] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.923] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.925] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0c0) returned 0x0 [0320.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.925] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0500) returned 0x0 [0320.925] WbemDefPath:IUnknown:Release (This=0x586b0c0) returned 0x0 [0320.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0500) returned 0x0 [0320.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.926] WbemDefPath:IUnknown:AddRef (This=0x6e0500) returned 0x3 [0320.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3b18) returned 0x0 [0320.926] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3b18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.926] WbemDefPath:IUnknown:Release (This=0x58c3b18) returned 0x3 [0320.926] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.927] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.927] WbemDefPath:IUnknown:Release (This=0x6e0500) returned 0x2 [0320.927] WbemDefPath:IUnknown:Release (This=0x6e0500) returned 0x1 [0320.927] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.927] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0500, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0500) returned 0x0 [0320.927] WbemDefPath:IUnknown:AddRef (This=0x6e0500) returned 0x3 [0320.927] WbemDefPath:IUnknown:Release (This=0x6e0500) returned 0x2 [0320.927] WbemDefPath:IWbemPath:SetText (This=0x6e0500, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x0 [0320.927] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.928] IWbemClassObject:Get (in: This=0x58bb0f8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233f004*=0, plFlavor=0x233f008*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x233f004*=8, plFlavor=0x233f008*=0) returned 0x0 [0320.928] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0320.928] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0320.928] IWbemClassObject:Get (in: This=0x58bb0f8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233f004*=8, plFlavor=0x233f008*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x233f004*=8, plFlavor=0x233f008*=0) returned 0x0 [0320.929] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0320.929] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0320.929] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0320.929] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x58ba5d0, puReturned=0x2320524*=0x1) returned 0x0 [0320.932] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba5d0) returned 0x0 [0320.932] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.932] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.932] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.933] IUnknown:AddRef (This=0x58ba5d0) returned 0x3 [0320.933] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.933] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.933] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba5d4) returned 0x0 [0320.933] IMarshal:GetUnmarshalClass (in: This=0x58ba5d4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.933] IUnknown:Release (This=0x58ba5d4) returned 0x3 [0320.933] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.933] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.934] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.934] IUnknown:Release (This=0x58ba5d0) returned 0x2 [0320.934] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.934] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.934] IUnknown:QueryInterface (in: This=0x58ba5d0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba5d0) returned 0x0 [0320.934] IUnknown:AddRef (This=0x58ba5d0) returned 0x4 [0320.934] IUnknown:Release (This=0x58ba5d0) returned 0x3 [0320.935] IUnknown:Release (This=0x58ba5d0) returned 0x2 [0320.935] CoTaskMemFree (pv=0x586b170) [0320.935] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.935] IUnknown:AddRef (This=0x58ba5d0) returned 0x3 [0320.936] IWbemClassObject:Get (in: This=0x58ba5d0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.936] IWbemClassObject:Get (in: This=0x58ba5d0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.936] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0320.936] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0320.936] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.937] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.937] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.937] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.938] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b290) returned 0x0 [0320.938] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b290, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.938] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b290, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e03b0) returned 0x0 [0320.938] WbemDefPath:IUnknown:Release (This=0x586b290) returned 0x0 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e03b0) returned 0x0 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.939] WbemDefPath:IUnknown:AddRef (This=0x6e03b0) returned 0x3 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3ae8) returned 0x0 [0320.940] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3ae8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.940] WbemDefPath:IUnknown:Release (This=0x58c3ae8) returned 0x3 [0320.940] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.940] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.940] WbemDefPath:IUnknown:Release (This=0x6e03b0) returned 0x2 [0320.940] WbemDefPath:IUnknown:Release (This=0x6e03b0) returned 0x1 [0320.940] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.940] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e03b0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e03b0) returned 0x0 [0320.941] WbemDefPath:IUnknown:AddRef (This=0x6e03b0) returned 0x3 [0320.941] WbemDefPath:IUnknown:Release (This=0x6e03b0) returned 0x2 [0320.941] WbemDefPath:IWbemPath:SetText (This=0x6e03b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.941] IWbemClassObject:Get (in: This=0x58ba5d0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233f8b0*=0, plFlavor=0x233f8b4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x233f8b0*=8, plFlavor=0x233f8b4*=0) returned 0x0 [0320.941] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0320.942] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0320.942] IWbemClassObject:Get (in: This=0x58ba5d0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x233f8b0*=8, plFlavor=0x233f8b4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x233f8b0*=8, plFlavor=0x233f8b4*=0) returned 0x0 [0320.942] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0320.942] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0320.942] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0320.942] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x58bbc20, puReturned=0x2320524*=0x1) returned 0x0 [0320.946] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bbc20) returned 0x0 [0320.946] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0320.946] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0320.946] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0320.946] IUnknown:AddRef (This=0x58bbc20) returned 0x3 [0320.947] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0320.947] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0320.947] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bbc24) returned 0x0 [0320.947] IMarshal:GetUnmarshalClass (in: This=0x58bbc24, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0320.947] IUnknown:Release (This=0x58bbc24) returned 0x3 [0320.947] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0320.947] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0320.947] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0320.947] IUnknown:Release (This=0x58bbc20) returned 0x2 [0320.947] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0320.947] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0320.947] IUnknown:QueryInterface (in: This=0x58bbc20, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bbc20) returned 0x0 [0320.948] IUnknown:AddRef (This=0x58bbc20) returned 0x4 [0320.948] IUnknown:Release (This=0x58bbc20) returned 0x3 [0320.948] IUnknown:Release (This=0x58bbc20) returned 0x2 [0320.948] CoTaskMemFree (pv=0x586b1c0) [0320.948] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0320.948] IUnknown:AddRef (This=0x58bbc20) returned 0x3 [0320.948] IWbemClassObject:Get (in: This=0x58bbc20, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0320.948] IWbemClassObject:Get (in: This=0x58bbc20, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0320.948] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0320.948] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0320.949] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0320.949] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0320.949] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0320.949] IUnknown:Release (This=0x692bc4) returned 0x1 [0320.950] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b2b0) returned 0x0 [0320.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2b0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0320.951] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2b0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e05e0) returned 0x0 [0320.951] WbemDefPath:IUnknown:Release (This=0x586b2b0) returned 0x0 [0320.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e05e0) returned 0x0 [0320.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0320.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0320.951] WbemDefPath:IUnknown:AddRef (This=0x6e05e0) returned 0x3 [0320.951] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0320.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0320.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3ed8) returned 0x0 [0320.952] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3ed8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0320.952] WbemDefPath:IUnknown:Release (This=0x58c3ed8) returned 0x3 [0320.952] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0320.952] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0320.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0320.952] WbemDefPath:IUnknown:Release (This=0x6e05e0) returned 0x2 [0320.952] WbemDefPath:IUnknown:Release (This=0x6e05e0) returned 0x1 [0320.953] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0320.953] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0320.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e05e0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e05e0) returned 0x0 [0320.953] WbemDefPath:IUnknown:AddRef (This=0x6e05e0) returned 0x3 [0320.953] WbemDefPath:IUnknown:Release (This=0x6e05e0) returned 0x2 [0320.953] WbemDefPath:IWbemPath:SetText (This=0x6e05e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0320.953] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0320.954] IWbemClassObject:Get (in: This=0x58bbc20, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2340154*=0, plFlavor=0x2340158*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x2340154*=8, plFlavor=0x2340158*=0) returned 0x0 [0320.954] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0320.954] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0320.954] IWbemClassObject:Get (in: This=0x58bbc20, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2340154*=8, plFlavor=0x2340158*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x2340154*=8, plFlavor=0x2340158*=0) returned 0x0 [0320.954] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0320.954] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0320.954] CoTaskMemAlloc (cb=0x4) returned 0x586b2a0 [0320.955] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b2a0, puReturned=0x2320524 | out: apObjects=0x586b2a0*=0x58bb290, puReturned=0x2320524*=0x1) returned 0x0 [0321.000] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb290) returned 0x0 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.001] IUnknown:AddRef (This=0x58bb290) returned 0x3 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.001] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb294) returned 0x0 [0321.002] IMarshal:GetUnmarshalClass (in: This=0x58bb294, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.002] IUnknown:Release (This=0x58bb294) returned 0x3 [0321.002] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.002] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.002] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.002] IUnknown:Release (This=0x58bb290) returned 0x2 [0321.002] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.002] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.002] IUnknown:QueryInterface (in: This=0x58bb290, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb290) returned 0x0 [0321.002] IUnknown:AddRef (This=0x58bb290) returned 0x4 [0321.003] IUnknown:Release (This=0x58bb290) returned 0x3 [0321.003] IUnknown:Release (This=0x58bb290) returned 0x2 [0321.003] CoTaskMemFree (pv=0x586b2a0) [0321.003] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.003] IUnknown:AddRef (This=0x58bb290) returned 0x3 [0321.003] IWbemClassObject:Get (in: This=0x58bb290, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.003] IWbemClassObject:Get (in: This=0x58bb290, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.003] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0321.003] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0321.003] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.004] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.004] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.004] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.005] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b2b0) returned 0x0 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2b0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.006] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2b0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0650) returned 0x0 [0321.006] WbemDefPath:IUnknown:Release (This=0x586b2b0) returned 0x0 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0650) returned 0x0 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.006] WbemDefPath:IUnknown:AddRef (This=0x6e0650) returned 0x3 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2228) returned 0x0 [0321.007] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2228, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.007] WbemDefPath:IUnknown:Release (This=0x58c2228) returned 0x3 [0321.007] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.007] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.007] WbemDefPath:IUnknown:Release (This=0x6e0650) returned 0x2 [0321.007] WbemDefPath:IUnknown:Release (This=0x6e0650) returned 0x1 [0321.007] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.007] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0650, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0650) returned 0x0 [0321.008] WbemDefPath:IUnknown:AddRef (This=0x6e0650) returned 0x3 [0321.008] WbemDefPath:IUnknown:Release (This=0x6e0650) returned 0x2 [0321.008] WbemDefPath:IWbemPath:SetText (This=0x6e0650, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.008] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.008] IWbemClassObject:Get (in: This=0x58bb290, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23409e0*=0, plFlavor=0x23409e4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x23409e0*=8, plFlavor=0x23409e4*=0) returned 0x0 [0321.009] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0321.009] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0321.009] IWbemClassObject:Get (in: This=0x58bb290, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23409e0*=8, plFlavor=0x23409e4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x23409e0*=8, plFlavor=0x23409e4*=0) returned 0x0 [0321.009] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0321.009] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0321.009] CoTaskMemAlloc (cb=0x4) returned 0x586b230 [0321.009] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b230, puReturned=0x2320524 | out: apObjects=0x586b230*=0x58bb5c0, puReturned=0x2320524*=0x1) returned 0x0 [0321.011] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb5c0) returned 0x0 [0321.012] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.012] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.012] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.012] IUnknown:AddRef (This=0x58bb5c0) returned 0x3 [0321.012] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.013] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.013] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb5c4) returned 0x0 [0321.013] IMarshal:GetUnmarshalClass (in: This=0x58bb5c4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.013] IUnknown:Release (This=0x58bb5c4) returned 0x3 [0321.013] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.013] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.013] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.014] IUnknown:Release (This=0x58bb5c0) returned 0x2 [0321.014] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.014] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.014] IUnknown:QueryInterface (in: This=0x58bb5c0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb5c0) returned 0x0 [0321.014] IUnknown:AddRef (This=0x58bb5c0) returned 0x4 [0321.014] IUnknown:Release (This=0x58bb5c0) returned 0x3 [0321.014] IUnknown:Release (This=0x58bb5c0) returned 0x2 [0321.014] CoTaskMemFree (pv=0x586b230) [0321.014] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.014] IUnknown:AddRef (This=0x58bb5c0) returned 0x3 [0321.014] IWbemClassObject:Get (in: This=0x58bb5c0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.015] IWbemClassObject:Get (in: This=0x58bb5c0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.015] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0321.015] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0321.015] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.015] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.015] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.015] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.017] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b270) returned 0x0 [0321.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b270, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.017] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b270, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e07a0) returned 0x0 [0321.017] WbemDefPath:IUnknown:Release (This=0x586b270) returned 0x0 [0321.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e07a0) returned 0x0 [0321.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.018] WbemDefPath:IUnknown:AddRef (This=0x6e07a0) returned 0x3 [0321.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2120) returned 0x0 [0321.018] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2120, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.018] WbemDefPath:IUnknown:Release (This=0x58c2120) returned 0x3 [0321.018] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.019] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.019] WbemDefPath:IUnknown:Release (This=0x6e07a0) returned 0x2 [0321.019] WbemDefPath:IUnknown:Release (This=0x6e07a0) returned 0x1 [0321.019] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.019] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e07a0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e07a0) returned 0x0 [0321.019] WbemDefPath:IUnknown:AddRef (This=0x6e07a0) returned 0x3 [0321.019] WbemDefPath:IUnknown:Release (This=0x6e07a0) returned 0x2 [0321.019] WbemDefPath:IWbemPath:SetText (This=0x6e07a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.020] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.020] IWbemClassObject:Get (in: This=0x58bb5c0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2341264*=0, plFlavor=0x2341268*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x2341264*=8, plFlavor=0x2341268*=0) returned 0x0 [0321.020] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0321.020] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0321.021] IWbemClassObject:Get (in: This=0x58bb5c0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2341264*=8, plFlavor=0x2341268*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x2341264*=8, plFlavor=0x2341268*=0) returned 0x0 [0321.021] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0321.021] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0321.021] CoTaskMemAlloc (cb=0x4) returned 0x586b120 [0321.021] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b120, puReturned=0x2320524 | out: apObjects=0x586b120*=0x58ba900, puReturned=0x2320524*=0x1) returned 0x0 [0321.024] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58ba900) returned 0x0 [0321.024] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.024] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.024] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.025] IUnknown:AddRef (This=0x58ba900) returned 0x3 [0321.025] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.025] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.025] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58ba904) returned 0x0 [0321.025] IMarshal:GetUnmarshalClass (in: This=0x58ba904, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.025] IUnknown:Release (This=0x58ba904) returned 0x3 [0321.025] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.025] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.026] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.026] IUnknown:Release (This=0x58ba900) returned 0x2 [0321.026] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.026] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.026] IUnknown:QueryInterface (in: This=0x58ba900, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58ba900) returned 0x0 [0321.026] IUnknown:AddRef (This=0x58ba900) returned 0x4 [0321.026] IUnknown:Release (This=0x58ba900) returned 0x3 [0321.026] IUnknown:Release (This=0x58ba900) returned 0x2 [0321.026] CoTaskMemFree (pv=0x586b120) [0321.026] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.026] IUnknown:AddRef (This=0x58ba900) returned 0x3 [0321.026] IWbemClassObject:Get (in: This=0x58ba900, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.027] IWbemClassObject:Get (in: This=0x58ba900, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.027] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0321.027] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0321.027] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.027] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.028] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.028] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.030] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b250) returned 0x0 [0321.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b250, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.030] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b250, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0880) returned 0x0 [0321.030] WbemDefPath:IUnknown:Release (This=0x586b250) returned 0x0 [0321.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0880) returned 0x0 [0321.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.031] WbemDefPath:IUnknown:AddRef (This=0x6e0880) returned 0x3 [0321.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2408) returned 0x0 [0321.031] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2408, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.031] WbemDefPath:IUnknown:Release (This=0x58c2408) returned 0x3 [0321.032] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.032] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.032] WbemDefPath:IUnknown:Release (This=0x6e0880) returned 0x2 [0321.032] WbemDefPath:IUnknown:Release (This=0x6e0880) returned 0x1 [0321.032] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.032] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0880, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0880) returned 0x0 [0321.032] WbemDefPath:IUnknown:AddRef (This=0x6e0880) returned 0x3 [0321.032] WbemDefPath:IUnknown:Release (This=0x6e0880) returned 0x2 [0321.032] WbemDefPath:IWbemPath:SetText (This=0x6e0880, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x0 [0321.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.033] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.033] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.033] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.033] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.033] IWbemClassObject:Get (in: This=0x58ba900, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2341af0*=0, plFlavor=0x2341af4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x2341af0*=8, plFlavor=0x2341af4*=0) returned 0x0 [0321.033] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0321.033] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0321.033] IWbemClassObject:Get (in: This=0x58ba900, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2341af0*=8, plFlavor=0x2341af4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x2341af0*=8, plFlavor=0x2341af4*=0) returned 0x0 [0321.033] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0321.034] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0321.034] CoTaskMemAlloc (cb=0x4) returned 0x586b0d0 [0321.034] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b0d0, puReturned=0x2320524 | out: apObjects=0x586b0d0*=0x58bb8f0, puReturned=0x2320524*=0x1) returned 0x0 [0321.095] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bb8f0) returned 0x0 [0321.095] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.095] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.095] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.096] IUnknown:AddRef (This=0x58bb8f0) returned 0x3 [0321.096] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.096] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.096] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bb8f4) returned 0x0 [0321.096] IMarshal:GetUnmarshalClass (in: This=0x58bb8f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.096] IUnknown:Release (This=0x58bb8f4) returned 0x3 [0321.096] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.097] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.097] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.097] IUnknown:Release (This=0x58bb8f0) returned 0x2 [0321.097] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.097] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.097] IUnknown:QueryInterface (in: This=0x58bb8f0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bb8f0) returned 0x0 [0321.097] IUnknown:AddRef (This=0x58bb8f0) returned 0x4 [0321.097] IUnknown:Release (This=0x58bb8f0) returned 0x3 [0321.097] IUnknown:Release (This=0x58bb8f0) returned 0x2 [0321.097] CoTaskMemFree (pv=0x586b0d0) [0321.097] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.097] IUnknown:AddRef (This=0x58bb8f0) returned 0x3 [0321.098] IWbemClassObject:Get (in: This=0x58bb8f0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.098] IWbemClassObject:Get (in: This=0x58bb8f0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.098] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0321.098] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0321.098] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.099] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.099] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.099] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.100] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b180) returned 0x0 [0321.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b180, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.101] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b180, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x6e0420) returned 0x0 [0321.101] WbemDefPath:IUnknown:Release (This=0x586b180) returned 0x0 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x6e0420) returned 0x0 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.101] WbemDefPath:IUnknown:AddRef (This=0x6e0420) returned 0x3 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c22b8) returned 0x0 [0321.102] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c22b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.102] WbemDefPath:IUnknown:Release (This=0x58c22b8) returned 0x3 [0321.102] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.102] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.102] WbemDefPath:IUnknown:Release (This=0x6e0420) returned 0x2 [0321.102] WbemDefPath:IUnknown:Release (This=0x6e0420) returned 0x1 [0321.102] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.102] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x6e0420, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x6e0420) returned 0x0 [0321.103] WbemDefPath:IUnknown:AddRef (This=0x6e0420) returned 0x3 [0321.103] WbemDefPath:IUnknown:Release (This=0x6e0420) returned 0x2 [0321.103] WbemDefPath:IWbemPath:SetText (This=0x6e0420, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.103] IWbemClassObject:Get (in: This=0x58bb8f0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234238c*=0, plFlavor=0x2342390*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x234238c*=8, plFlavor=0x2342390*=0) returned 0x0 [0321.104] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0321.104] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0321.104] IWbemClassObject:Get (in: This=0x58bb8f0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234238c*=8, plFlavor=0x2342390*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x234238c*=8, plFlavor=0x2342390*=0) returned 0x0 [0321.104] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0321.104] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0321.104] CoTaskMemAlloc (cb=0x4) returned 0x586b120 [0321.104] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b120, puReturned=0x2320524 | out: apObjects=0x586b120*=0x58b9f70, puReturned=0x2320524*=0x1) returned 0x0 [0321.108] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58b9f70) returned 0x0 [0321.108] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.108] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.108] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.109] IUnknown:AddRef (This=0x58b9f70) returned 0x3 [0321.109] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.109] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.109] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58b9f74) returned 0x0 [0321.109] IMarshal:GetUnmarshalClass (in: This=0x58b9f74, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.109] IUnknown:Release (This=0x58b9f74) returned 0x3 [0321.109] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.109] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.110] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.110] IUnknown:Release (This=0x58b9f70) returned 0x2 [0321.110] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.110] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.110] IUnknown:QueryInterface (in: This=0x58b9f70, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58b9f70) returned 0x0 [0321.110] IUnknown:AddRef (This=0x58b9f70) returned 0x4 [0321.110] IUnknown:Release (This=0x58b9f70) returned 0x3 [0321.110] IUnknown:Release (This=0x58b9f70) returned 0x2 [0321.110] CoTaskMemFree (pv=0x586b120) [0321.110] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.110] IUnknown:AddRef (This=0x58b9f70) returned 0x3 [0321.111] IWbemClassObject:Get (in: This=0x58b9f70, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.111] IWbemClassObject:Get (in: This=0x58b9f70, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.111] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0321.111] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0321.112] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.112] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.112] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.113] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b290) returned 0x0 [0321.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b290, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.114] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b290, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872880) returned 0x0 [0321.114] WbemDefPath:IUnknown:Release (This=0x586b290) returned 0x0 [0321.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872880) returned 0x0 [0321.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.115] WbemDefPath:IUnknown:AddRef (This=0x5872880) returned 0x3 [0321.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c27e0) returned 0x0 [0321.115] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c27e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.115] WbemDefPath:IUnknown:Release (This=0x58c27e0) returned 0x3 [0321.115] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.115] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.116] WbemDefPath:IUnknown:Release (This=0x5872880) returned 0x2 [0321.116] WbemDefPath:IUnknown:Release (This=0x5872880) returned 0x1 [0321.116] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.116] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872880, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872880) returned 0x0 [0321.116] WbemDefPath:IUnknown:AddRef (This=0x5872880) returned 0x3 [0321.116] WbemDefPath:IUnknown:Release (This=0x5872880) returned 0x2 [0321.116] WbemDefPath:IWbemPath:SetText (This=0x5872880, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x0 [0321.116] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.116] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.116] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.116] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.117] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.117] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.117] IWbemClassObject:Get (in: This=0x58b9f70, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2342c40*=0, plFlavor=0x2342c44*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x2342c40*=8, plFlavor=0x2342c44*=0) returned 0x0 [0321.117] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0321.117] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0321.117] IWbemClassObject:Get (in: This=0x58b9f70, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2342c40*=8, plFlavor=0x2342c44*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x2342c40*=8, plFlavor=0x2342c44*=0) returned 0x0 [0321.117] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0321.117] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0321.118] CoTaskMemAlloc (cb=0x4) returned 0x586b280 [0321.118] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b280, puReturned=0x2320524 | out: apObjects=0x586b280*=0x58bba88, puReturned=0x2320524*=0x1) returned 0x0 [0321.120] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x58bba88) returned 0x0 [0321.120] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.120] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.120] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.120] IUnknown:AddRef (This=0x58bba88) returned 0x3 [0321.121] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.121] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.121] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x58bba8c) returned 0x0 [0321.121] IMarshal:GetUnmarshalClass (in: This=0x58bba8c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.121] IUnknown:Release (This=0x58bba8c) returned 0x3 [0321.121] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.121] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.121] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.122] IUnknown:Release (This=0x58bba88) returned 0x2 [0321.122] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.122] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.122] IUnknown:QueryInterface (in: This=0x58bba88, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x58bba88) returned 0x0 [0321.122] IUnknown:AddRef (This=0x58bba88) returned 0x4 [0321.122] IUnknown:Release (This=0x58bba88) returned 0x3 [0321.122] IUnknown:Release (This=0x58bba88) returned 0x2 [0321.123] CoTaskMemFree (pv=0x586b280) [0321.123] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.123] IUnknown:AddRef (This=0x58bba88) returned 0x3 [0321.123] IWbemClassObject:Get (in: This=0x58bba88, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.123] IWbemClassObject:Get (in: This=0x58bba88, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.123] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0321.123] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0321.124] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.124] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.124] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.124] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.125] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b180) returned 0x0 [0321.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b180, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.126] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b180, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872b20) returned 0x0 [0321.126] WbemDefPath:IUnknown:Release (This=0x586b180) returned 0x0 [0321.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872b20) returned 0x0 [0321.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.127] WbemDefPath:IUnknown:AddRef (This=0x5872b20) returned 0x3 [0321.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2978) returned 0x0 [0321.127] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2978, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.127] WbemDefPath:IUnknown:Release (This=0x58c2978) returned 0x3 [0321.127] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.127] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.127] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.128] WbemDefPath:IUnknown:Release (This=0x5872b20) returned 0x2 [0321.128] WbemDefPath:IUnknown:Release (This=0x5872b20) returned 0x1 [0321.128] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.128] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b20, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872b20) returned 0x0 [0321.128] WbemDefPath:IUnknown:AddRef (This=0x5872b20) returned 0x3 [0321.128] WbemDefPath:IUnknown:Release (This=0x5872b20) returned 0x2 [0321.128] WbemDefPath:IWbemPath:SetText (This=0x5872b20, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x0 [0321.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.129] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.129] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.129] IWbemClassObject:Get (in: This=0x58bba88, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23434e4*=0, plFlavor=0x23434e8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x23434e4*=8, plFlavor=0x23434e8*=0) returned 0x0 [0321.129] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0321.129] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0321.129] IWbemClassObject:Get (in: This=0x58bba88, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23434e4*=8, plFlavor=0x23434e8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x23434e4*=8, plFlavor=0x23434e8*=0) returned 0x0 [0321.129] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0321.129] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0321.130] CoTaskMemAlloc (cb=0x4) returned 0x586b280 [0321.130] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b280, puReturned=0x2320524 | out: apObjects=0x586b280*=0x6cb130, puReturned=0x2320524*=0x1) returned 0x0 [0321.234] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cb130) returned 0x0 [0321.234] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.234] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.235] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.235] IUnknown:AddRef (This=0x6cb130) returned 0x3 [0321.235] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.235] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.235] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cb134) returned 0x0 [0321.235] IMarshal:GetUnmarshalClass (in: This=0x6cb134, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.235] IUnknown:Release (This=0x6cb134) returned 0x3 [0321.235] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.236] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.236] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.236] IUnknown:Release (This=0x6cb130) returned 0x2 [0321.236] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.236] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.236] IUnknown:QueryInterface (in: This=0x6cb130, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cb130) returned 0x0 [0321.236] IUnknown:AddRef (This=0x6cb130) returned 0x4 [0321.236] IUnknown:Release (This=0x6cb130) returned 0x3 [0321.236] IUnknown:Release (This=0x6cb130) returned 0x2 [0321.236] CoTaskMemFree (pv=0x586b280) [0321.236] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.237] IUnknown:AddRef (This=0x6cb130) returned 0x3 [0321.237] IWbemClassObject:Get (in: This=0x6cb130, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.237] IWbemClassObject:Get (in: This=0x6cb130, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.237] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0321.237] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0321.237] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.238] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.238] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.238] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.239] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b110) returned 0x0 [0321.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b110, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.240] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b110, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872ab0) returned 0x0 [0321.240] WbemDefPath:IUnknown:Release (This=0x586b110) returned 0x0 [0321.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872ab0) returned 0x0 [0321.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.240] WbemDefPath:IUnknown:AddRef (This=0x5872ab0) returned 0x3 [0321.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c28d0) returned 0x0 [0321.241] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c28d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.241] WbemDefPath:IUnknown:Release (This=0x58c28d0) returned 0x3 [0321.241] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.241] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.241] WbemDefPath:IUnknown:Release (This=0x5872ab0) returned 0x2 [0321.241] WbemDefPath:IUnknown:Release (This=0x5872ab0) returned 0x1 [0321.242] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.242] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ab0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872ab0) returned 0x0 [0321.242] WbemDefPath:IUnknown:AddRef (This=0x5872ab0) returned 0x3 [0321.242] WbemDefPath:IUnknown:Release (This=0x5872ab0) returned 0x2 [0321.242] WbemDefPath:IWbemPath:SetText (This=0x5872ab0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.243] IWbemClassObject:Get (in: This=0x6cb130, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2343d70*=0, plFlavor=0x2343d74*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x2343d70*=8, plFlavor=0x2343d74*=0) returned 0x0 [0321.243] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0321.243] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0321.243] IWbemClassObject:Get (in: This=0x6cb130, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2343d70*=8, plFlavor=0x2343d74*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x2343d70*=8, plFlavor=0x2343d74*=0) returned 0x0 [0321.243] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0321.243] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0321.244] CoTaskMemAlloc (cb=0x4) returned 0x586b160 [0321.244] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b160, puReturned=0x2320524 | out: apObjects=0x586b160*=0x6cb2c8, puReturned=0x2320524*=0x1) returned 0x0 [0321.245] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cb2c8) returned 0x0 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.246] IUnknown:AddRef (This=0x6cb2c8) returned 0x3 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.246] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cb2cc) returned 0x0 [0321.246] IMarshal:GetUnmarshalClass (in: This=0x6cb2cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.247] IUnknown:Release (This=0x6cb2cc) returned 0x3 [0321.259] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.259] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.259] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.259] IUnknown:Release (This=0x6cb2c8) returned 0x2 [0321.259] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.259] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.259] IUnknown:QueryInterface (in: This=0x6cb2c8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cb2c8) returned 0x0 [0321.259] IUnknown:AddRef (This=0x6cb2c8) returned 0x4 [0321.260] IUnknown:Release (This=0x6cb2c8) returned 0x3 [0321.260] IUnknown:Release (This=0x6cb2c8) returned 0x2 [0321.260] CoTaskMemFree (pv=0x586b160) [0321.260] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.260] IUnknown:AddRef (This=0x6cb2c8) returned 0x3 [0321.260] IWbemClassObject:Get (in: This=0x6cb2c8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.260] IWbemClassObject:Get (in: This=0x6cb2c8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.260] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0321.260] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0321.261] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.261] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.261] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.261] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.264] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b0d0) returned 0x0 [0321.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0d0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.264] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0d0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872c00) returned 0x0 [0321.264] WbemDefPath:IUnknown:Release (This=0x586b0d0) returned 0x0 [0321.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872c00) returned 0x0 [0321.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.265] WbemDefPath:IUnknown:AddRef (This=0x5872c00) returned 0x3 [0321.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2cd8) returned 0x0 [0321.265] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2cd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.266] WbemDefPath:IUnknown:Release (This=0x58c2cd8) returned 0x3 [0321.266] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.266] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.266] WbemDefPath:IUnknown:Release (This=0x5872c00) returned 0x2 [0321.266] WbemDefPath:IUnknown:Release (This=0x5872c00) returned 0x1 [0321.266] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.266] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.266] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c00, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872c00) returned 0x0 [0321.266] WbemDefPath:IUnknown:AddRef (This=0x5872c00) returned 0x3 [0321.267] WbemDefPath:IUnknown:Release (This=0x5872c00) returned 0x2 [0321.267] WbemDefPath:IWbemPath:SetText (This=0x5872c00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.267] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.267] IWbemClassObject:Get (in: This=0x6cb2c8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23445f4*=0, plFlavor=0x23445f8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x23445f4*=8, plFlavor=0x23445f8*=0) returned 0x0 [0321.268] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0321.268] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0321.268] IWbemClassObject:Get (in: This=0x6cb2c8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23445f4*=8, plFlavor=0x23445f8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x23445f4*=8, plFlavor=0x23445f8*=0) returned 0x0 [0321.268] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0321.268] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0321.268] CoTaskMemAlloc (cb=0x4) returned 0x586b270 [0321.269] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b270, puReturned=0x2320524 | out: apObjects=0x586b270*=0x6cc450, puReturned=0x2320524*=0x1) returned 0x0 [0321.271] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cc450) returned 0x0 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.272] IUnknown:AddRef (This=0x6cc450) returned 0x3 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.272] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cc454) returned 0x0 [0321.273] IMarshal:GetUnmarshalClass (in: This=0x6cc454, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.273] IUnknown:Release (This=0x6cc454) returned 0x3 [0321.273] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.273] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.273] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.273] IUnknown:Release (This=0x6cc450) returned 0x2 [0321.273] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.273] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.273] IUnknown:QueryInterface (in: This=0x6cc450, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cc450) returned 0x0 [0321.273] IUnknown:AddRef (This=0x6cc450) returned 0x4 [0321.274] IUnknown:Release (This=0x6cc450) returned 0x3 [0321.274] IUnknown:Release (This=0x6cc450) returned 0x2 [0321.274] CoTaskMemFree (pv=0x586b270) [0321.274] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.274] IUnknown:AddRef (This=0x6cc450) returned 0x3 [0321.274] IWbemClassObject:Get (in: This=0x6cc450, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.274] IWbemClassObject:Get (in: This=0x6cc450, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.275] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0321.275] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0321.276] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.276] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.276] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.276] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.277] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b260) returned 0x0 [0321.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b260, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.278] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b260, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x58725e0) returned 0x0 [0321.278] WbemDefPath:IUnknown:Release (This=0x586b260) returned 0x0 [0321.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x58725e0) returned 0x0 [0321.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.365] WbemDefPath:IUnknown:AddRef (This=0x58725e0) returned 0x3 [0321.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c2d50) returned 0x0 [0321.366] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c2d50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.366] WbemDefPath:IUnknown:Release (This=0x58c2d50) returned 0x3 [0321.366] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.366] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.366] WbemDefPath:IUnknown:Release (This=0x58725e0) returned 0x2 [0321.366] WbemDefPath:IUnknown:Release (This=0x58725e0) returned 0x1 [0321.366] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.367] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x58725e0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x58725e0) returned 0x0 [0321.367] WbemDefPath:IUnknown:AddRef (This=0x58725e0) returned 0x3 [0321.367] WbemDefPath:IUnknown:Release (This=0x58725e0) returned 0x2 [0321.367] WbemDefPath:IWbemPath:SetText (This=0x58725e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.367] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.368] IWbemClassObject:Get (in: This=0x6cc450, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344e80*=0, plFlavor=0x2344e84*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x2344e80*=8, plFlavor=0x2344e84*=0) returned 0x0 [0321.368] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0321.368] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0321.368] IWbemClassObject:Get (in: This=0x6cc450, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2344e80*=8, plFlavor=0x2344e84*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x2344e80*=8, plFlavor=0x2344e84*=0) returned 0x0 [0321.368] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0321.368] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0321.368] CoTaskMemAlloc (cb=0x4) returned 0x586b180 [0321.369] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b180, puReturned=0x2320524 | out: apObjects=0x586b180*=0x6cb5f8, puReturned=0x2320524*=0x1) returned 0x0 [0321.370] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cb5f8) returned 0x0 [0321.371] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.371] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.371] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.371] IUnknown:AddRef (This=0x6cb5f8) returned 0x3 [0321.371] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.371] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.372] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cb5fc) returned 0x0 [0321.372] IMarshal:GetUnmarshalClass (in: This=0x6cb5fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.372] IUnknown:Release (This=0x6cb5fc) returned 0x3 [0321.372] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.373] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.373] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.373] IUnknown:Release (This=0x6cb5f8) returned 0x2 [0321.373] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.373] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.373] IUnknown:QueryInterface (in: This=0x6cb5f8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cb5f8) returned 0x0 [0321.373] IUnknown:AddRef (This=0x6cb5f8) returned 0x4 [0321.373] IUnknown:Release (This=0x6cb5f8) returned 0x3 [0321.373] IUnknown:Release (This=0x6cb5f8) returned 0x2 [0321.373] CoTaskMemFree (pv=0x586b180) [0321.374] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.374] IUnknown:AddRef (This=0x6cb5f8) returned 0x3 [0321.374] IWbemClassObject:Get (in: This=0x6cb5f8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.374] IWbemClassObject:Get (in: This=0x6cb5f8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.374] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0321.374] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0321.374] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.375] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.375] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.375] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.376] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0321.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.377] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872b90) returned 0x0 [0321.377] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0321.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872b90) returned 0x0 [0321.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.377] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.377] WbemDefPath:IUnknown:AddRef (This=0x5872b90) returned 0x3 [0321.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3080) returned 0x0 [0321.378] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3080, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.378] WbemDefPath:IUnknown:Release (This=0x58c3080) returned 0x3 [0321.378] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.378] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.378] WbemDefPath:IUnknown:Release (This=0x5872b90) returned 0x2 [0321.378] WbemDefPath:IUnknown:Release (This=0x5872b90) returned 0x1 [0321.379] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.379] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872b90, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872b90) returned 0x0 [0321.379] WbemDefPath:IUnknown:AddRef (This=0x5872b90) returned 0x3 [0321.379] WbemDefPath:IUnknown:Release (This=0x5872b90) returned 0x2 [0321.379] WbemDefPath:IWbemPath:SetText (This=0x5872b90, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.379] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.380] IWbemClassObject:Get (in: This=0x6cb5f8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345724*=0, plFlavor=0x2345728*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x2345724*=8, plFlavor=0x2345728*=0) returned 0x0 [0321.380] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0321.380] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0321.380] IWbemClassObject:Get (in: This=0x6cb5f8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345724*=8, plFlavor=0x2345728*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x2345724*=8, plFlavor=0x2345728*=0) returned 0x0 [0321.380] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0321.380] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0321.380] CoTaskMemAlloc (cb=0x4) returned 0x586b1e0 [0321.381] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1e0, puReturned=0x2320524 | out: apObjects=0x586b1e0*=0x6caf98, puReturned=0x2320524*=0x1) returned 0x0 [0321.382] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6caf98) returned 0x0 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.383] IUnknown:AddRef (This=0x6caf98) returned 0x3 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.383] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6caf9c) returned 0x0 [0321.384] IMarshal:GetUnmarshalClass (in: This=0x6caf9c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.384] IUnknown:Release (This=0x6caf9c) returned 0x3 [0321.384] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.384] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.384] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.384] IUnknown:Release (This=0x6caf98) returned 0x2 [0321.384] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.384] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.384] IUnknown:QueryInterface (in: This=0x6caf98, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6caf98) returned 0x0 [0321.384] IUnknown:AddRef (This=0x6caf98) returned 0x4 [0321.385] IUnknown:Release (This=0x6caf98) returned 0x3 [0321.385] IUnknown:Release (This=0x6caf98) returned 0x2 [0321.385] CoTaskMemFree (pv=0x586b1e0) [0321.385] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.385] IUnknown:AddRef (This=0x6caf98) returned 0x3 [0321.385] IWbemClassObject:Get (in: This=0x6caf98, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.385] IWbemClassObject:Get (in: This=0x6caf98, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.386] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0321.386] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0321.387] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.387] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.387] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.387] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.389] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b180) returned 0x0 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b180, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.390] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b180, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872ea0) returned 0x0 [0321.390] WbemDefPath:IUnknown:Release (This=0x586b180) returned 0x0 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872ea0) returned 0x0 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.390] WbemDefPath:IUnknown:AddRef (This=0x5872ea0) returned 0x3 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.390] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3188) returned 0x0 [0321.391] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3188, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.391] WbemDefPath:IUnknown:Release (This=0x58c3188) returned 0x3 [0321.391] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.391] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.391] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.391] WbemDefPath:IUnknown:Release (This=0x5872ea0) returned 0x2 [0321.391] WbemDefPath:IUnknown:Release (This=0x5872ea0) returned 0x1 [0321.391] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.391] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ea0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872ea0) returned 0x0 [0321.392] WbemDefPath:IUnknown:AddRef (This=0x5872ea0) returned 0x3 [0321.392] WbemDefPath:IUnknown:Release (This=0x5872ea0) returned 0x2 [0321.392] WbemDefPath:IWbemPath:SetText (This=0x5872ea0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.392] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.392] IWbemClassObject:Get (in: This=0x6caf98, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345fb0*=0, plFlavor=0x2345fb4*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x2345fb0*=8, plFlavor=0x2345fb4*=0) returned 0x0 [0321.393] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0321.393] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0321.393] IWbemClassObject:Get (in: This=0x6caf98, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2345fb0*=8, plFlavor=0x2345fb4*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x2345fb0*=8, plFlavor=0x2345fb4*=0) returned 0x0 [0321.393] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0321.393] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0321.393] CoTaskMemAlloc (cb=0x4) returned 0x586b1c0 [0321.393] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1c0, puReturned=0x2320524 | out: apObjects=0x586b1c0*=0x6ca7a0, puReturned=0x2320524*=0x1) returned 0x0 [0321.594] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6ca7a0) returned 0x0 [0321.594] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.594] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.595] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.595] IUnknown:AddRef (This=0x6ca7a0) returned 0x3 [0321.595] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.596] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.596] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6ca7a4) returned 0x0 [0321.596] IMarshal:GetUnmarshalClass (in: This=0x6ca7a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.596] IUnknown:Release (This=0x6ca7a4) returned 0x3 [0321.596] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.596] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.596] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.596] IUnknown:Release (This=0x6ca7a0) returned 0x2 [0321.596] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.597] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.597] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6ca7a0) returned 0x0 [0321.597] IUnknown:AddRef (This=0x6ca7a0) returned 0x4 [0321.597] IUnknown:Release (This=0x6ca7a0) returned 0x3 [0321.597] IUnknown:Release (This=0x6ca7a0) returned 0x2 [0321.597] CoTaskMemFree (pv=0x586b1c0) [0321.597] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.597] IUnknown:AddRef (This=0x6ca7a0) returned 0x3 [0321.597] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.597] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.598] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0321.598] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0321.598] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.598] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.598] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.598] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.600] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b190) returned 0x0 [0321.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b190, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.600] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b190, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872f10) returned 0x0 [0321.600] WbemDefPath:IUnknown:Release (This=0x586b190) returned 0x0 [0321.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872f10) returned 0x0 [0321.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.601] WbemDefPath:IUnknown:AddRef (This=0x5872f10) returned 0x3 [0321.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3440) returned 0x0 [0321.601] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3440, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.601] WbemDefPath:IUnknown:Release (This=0x58c3440) returned 0x3 [0321.601] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.601] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.602] WbemDefPath:IUnknown:Release (This=0x5872f10) returned 0x2 [0321.602] WbemDefPath:IUnknown:Release (This=0x5872f10) returned 0x1 [0321.602] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.602] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f10, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872f10) returned 0x0 [0321.602] WbemDefPath:IUnknown:AddRef (This=0x5872f10) returned 0x3 [0321.602] WbemDefPath:IUnknown:Release (This=0x5872f10) returned 0x2 [0321.602] WbemDefPath:IWbemPath:SetText (This=0x5872f10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x0 [0321.602] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.602] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.602] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.603] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.603] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.603] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234683c*=0, plFlavor=0x2346840*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x234683c*=8, plFlavor=0x2346840*=0) returned 0x0 [0321.603] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0321.603] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0321.603] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234683c*=8, plFlavor=0x2346840*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x234683c*=8, plFlavor=0x2346840*=0) returned 0x0 [0321.603] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0321.603] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0321.604] CoTaskMemAlloc (cb=0x4) returned 0x586b280 [0321.604] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b280, puReturned=0x2320524 | out: apObjects=0x586b280*=0x6cb460, puReturned=0x2320524*=0x1) returned 0x0 [0321.608] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cb460) returned 0x0 [0321.608] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.608] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.608] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.609] IUnknown:AddRef (This=0x6cb460) returned 0x3 [0321.609] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.609] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.609] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cb464) returned 0x0 [0321.609] IMarshal:GetUnmarshalClass (in: This=0x6cb464, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.609] IUnknown:Release (This=0x6cb464) returned 0x3 [0321.609] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.609] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.609] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.610] IUnknown:Release (This=0x6cb460) returned 0x2 [0321.610] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.610] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.610] IUnknown:QueryInterface (in: This=0x6cb460, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cb460) returned 0x0 [0321.610] IUnknown:AddRef (This=0x6cb460) returned 0x4 [0321.610] IUnknown:Release (This=0x6cb460) returned 0x3 [0321.610] IUnknown:Release (This=0x6cb460) returned 0x2 [0321.610] CoTaskMemFree (pv=0x586b280) [0321.610] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.610] IUnknown:AddRef (This=0x6cb460) returned 0x3 [0321.610] IWbemClassObject:Get (in: This=0x6cb460, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.611] IWbemClassObject:Get (in: This=0x6cb460, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.611] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0321.611] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0321.611] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.611] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.611] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.611] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.613] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b200) returned 0x0 [0321.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.613] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b200, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x58728f0) returned 0x0 [0321.613] WbemDefPath:IUnknown:Release (This=0x586b200) returned 0x0 [0321.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x58728f0) returned 0x0 [0321.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.614] WbemDefPath:IUnknown:AddRef (This=0x58728f0) returned 0x3 [0321.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3500) returned 0x0 [0321.614] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3500, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.614] WbemDefPath:IUnknown:Release (This=0x58c3500) returned 0x3 [0321.614] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.615] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.615] WbemDefPath:IUnknown:Release (This=0x58728f0) returned 0x2 [0321.615] WbemDefPath:IUnknown:Release (This=0x58728f0) returned 0x1 [0321.615] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.615] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x58728f0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x58728f0) returned 0x0 [0321.615] WbemDefPath:IUnknown:AddRef (This=0x58728f0) returned 0x3 [0321.615] WbemDefPath:IUnknown:Release (This=0x58728f0) returned 0x2 [0321.615] WbemDefPath:IWbemPath:SetText (This=0x58728f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x0 [0321.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.615] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.616] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.616] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.616] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.616] IWbemClassObject:Get (in: This=0x6cb460, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23470e8*=0, plFlavor=0x23470ec*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23470e8*=8, plFlavor=0x23470ec*=0) returned 0x0 [0321.616] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0321.616] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0321.616] IWbemClassObject:Get (in: This=0x6cb460, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23470e8*=8, plFlavor=0x23470ec*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23470e8*=8, plFlavor=0x23470ec*=0) returned 0x0 [0321.616] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0321.617] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0321.617] CoTaskMemAlloc (cb=0x4) returned 0x586b110 [0321.617] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b110, puReturned=0x2320524 | out: apObjects=0x586b110*=0x6cc2b8, puReturned=0x2320524*=0x1) returned 0x0 [0321.624] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cc2b8) returned 0x0 [0321.624] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.624] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.624] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.625] IUnknown:AddRef (This=0x6cc2b8) returned 0x3 [0321.625] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.625] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.625] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cc2bc) returned 0x0 [0321.625] IMarshal:GetUnmarshalClass (in: This=0x6cc2bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.625] IUnknown:Release (This=0x6cc2bc) returned 0x3 [0321.626] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.626] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.626] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.626] IUnknown:Release (This=0x6cc2b8) returned 0x2 [0321.626] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.626] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.626] IUnknown:QueryInterface (in: This=0x6cc2b8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cc2b8) returned 0x0 [0321.626] IUnknown:AddRef (This=0x6cc2b8) returned 0x4 [0321.626] IUnknown:Release (This=0x6cc2b8) returned 0x3 [0321.626] IUnknown:Release (This=0x6cc2b8) returned 0x2 [0321.627] CoTaskMemFree (pv=0x586b110) [0321.627] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.627] IUnknown:AddRef (This=0x6cc2b8) returned 0x3 [0321.627] IWbemClassObject:Get (in: This=0x6cc2b8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.627] IWbemClassObject:Get (in: This=0x6cc2b8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.627] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0321.627] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0321.628] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.628] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.628] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.628] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.630] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b280) returned 0x0 [0321.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b280, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.630] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b280, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872650) returned 0x0 [0321.630] WbemDefPath:IUnknown:Release (This=0x586b280) returned 0x0 [0321.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872650) returned 0x0 [0321.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.630] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.631] WbemDefPath:IUnknown:AddRef (This=0x5872650) returned 0x3 [0321.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3710) returned 0x0 [0321.631] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3710, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.631] WbemDefPath:IUnknown:Release (This=0x58c3710) returned 0x3 [0321.631] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.632] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.632] WbemDefPath:IUnknown:Release (This=0x5872650) returned 0x2 [0321.632] WbemDefPath:IUnknown:Release (This=0x5872650) returned 0x1 [0321.632] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.632] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872650, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872650) returned 0x0 [0321.632] WbemDefPath:IUnknown:AddRef (This=0x5872650) returned 0x3 [0321.632] WbemDefPath:IUnknown:Release (This=0x5872650) returned 0x2 [0321.632] WbemDefPath:IWbemPath:SetText (This=0x5872650, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x0 [0321.632] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.633] IWbemClassObject:Get (in: This=0x6cc2b8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234796c*=0, plFlavor=0x2347970*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x234796c*=8, plFlavor=0x2347970*=0) returned 0x0 [0321.633] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0321.633] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0321.634] IWbemClassObject:Get (in: This=0x6cc2b8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x234796c*=8, plFlavor=0x2347970*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x234796c*=8, plFlavor=0x2347970*=0) returned 0x0 [0321.634] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0321.634] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0321.634] CoTaskMemAlloc (cb=0x4) returned 0x586b120 [0321.634] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b120, puReturned=0x2320524 | out: apObjects=0x586b120*=0x6cbc58, puReturned=0x2320524*=0x1) returned 0x0 [0321.697] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cbc58) returned 0x0 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.698] IUnknown:AddRef (This=0x6cbc58) returned 0x3 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.698] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cbc5c) returned 0x0 [0321.698] IMarshal:GetUnmarshalClass (in: This=0x6cbc5c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.699] IUnknown:Release (This=0x6cbc5c) returned 0x3 [0321.699] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.699] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.699] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.699] IUnknown:Release (This=0x6cbc58) returned 0x2 [0321.699] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.699] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.699] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cbc58) returned 0x0 [0321.699] IUnknown:AddRef (This=0x6cbc58) returned 0x4 [0321.699] IUnknown:Release (This=0x6cbc58) returned 0x3 [0321.699] IUnknown:Release (This=0x6cbc58) returned 0x2 [0321.699] CoTaskMemFree (pv=0x586b120) [0321.699] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.699] IUnknown:AddRef (This=0x6cbc58) returned 0x3 [0321.700] IWbemClassObject:Get (in: This=0x6cbc58, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.700] IWbemClassObject:Get (in: This=0x6cbc58, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.700] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0321.700] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0321.700] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.701] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.701] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.701] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.702] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b230) returned 0x0 [0321.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b230, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.702] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b230, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872c70) returned 0x0 [0321.702] WbemDefPath:IUnknown:Release (This=0x586b230) returned 0x0 [0321.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872c70) returned 0x0 [0321.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.703] WbemDefPath:IUnknown:AddRef (This=0x5872c70) returned 0x3 [0321.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3860) returned 0x0 [0321.703] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3860, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.703] WbemDefPath:IUnknown:Release (This=0x58c3860) returned 0x3 [0321.703] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.703] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.703] WbemDefPath:IUnknown:Release (This=0x5872c70) returned 0x2 [0321.703] WbemDefPath:IUnknown:Release (This=0x5872c70) returned 0x1 [0321.703] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.703] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872c70, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872c70) returned 0x0 [0321.704] WbemDefPath:IUnknown:AddRef (This=0x5872c70) returned 0x3 [0321.704] WbemDefPath:IUnknown:Release (This=0x5872c70) returned 0x2 [0321.704] WbemDefPath:IWbemPath:SetText (This=0x5872c70, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.704] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.704] IWbemClassObject:Get (in: This=0x6cbc58, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2348208*=0, plFlavor=0x234820c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x2348208*=8, plFlavor=0x234820c*=0) returned 0x0 [0321.704] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0321.704] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0321.705] IWbemClassObject:Get (in: This=0x6cbc58, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2348208*=8, plFlavor=0x234820c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x2348208*=8, plFlavor=0x234820c*=0) returned 0x0 [0321.705] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0321.705] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0321.705] CoTaskMemAlloc (cb=0x4) returned 0x586b1e0 [0321.705] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b1e0, puReturned=0x2320524 | out: apObjects=0x586b1e0*=0x6cc5e8, puReturned=0x2320524*=0x1) returned 0x0 [0321.707] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cc5e8) returned 0x0 [0321.707] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.707] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.707] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.708] IUnknown:AddRef (This=0x6cc5e8) returned 0x3 [0321.708] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.708] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.708] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cc5ec) returned 0x0 [0321.708] IMarshal:GetUnmarshalClass (in: This=0x6cc5ec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.708] IUnknown:Release (This=0x6cc5ec) returned 0x3 [0321.708] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.708] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.708] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.708] IUnknown:Release (This=0x6cc5e8) returned 0x2 [0321.709] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.709] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.709] IUnknown:QueryInterface (in: This=0x6cc5e8, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cc5e8) returned 0x0 [0321.709] IUnknown:AddRef (This=0x6cc5e8) returned 0x4 [0321.709] IUnknown:Release (This=0x6cc5e8) returned 0x3 [0321.709] IUnknown:Release (This=0x6cc5e8) returned 0x2 [0321.709] CoTaskMemFree (pv=0x586b1e0) [0321.709] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.709] IUnknown:AddRef (This=0x6cc5e8) returned 0x3 [0321.709] IWbemClassObject:Get (in: This=0x6cc5e8, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.709] IWbemClassObject:Get (in: This=0x6cc5e8, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.709] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0321.710] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0321.710] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.710] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.710] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.710] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.711] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b2a0) returned 0x0 [0321.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2a0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.712] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2a0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872500) returned 0x0 [0321.712] WbemDefPath:IUnknown:Release (This=0x586b2a0) returned 0x0 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872500) returned 0x0 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.712] WbemDefPath:IUnknown:AddRef (This=0x5872500) returned 0x3 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58c3aa0) returned 0x0 [0321.712] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c3aa0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.712] WbemDefPath:IUnknown:Release (This=0x58c3aa0) returned 0x3 [0321.713] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.713] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.713] WbemDefPath:IUnknown:Release (This=0x5872500) returned 0x2 [0321.713] WbemDefPath:IUnknown:Release (This=0x5872500) returned 0x1 [0321.713] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.713] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872500, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872500) returned 0x0 [0321.713] WbemDefPath:IUnknown:AddRef (This=0x5872500) returned 0x3 [0321.713] WbemDefPath:IUnknown:Release (This=0x5872500) returned 0x2 [0321.713] WbemDefPath:IWbemPath:SetText (This=0x5872500, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.714] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.714] IWbemClassObject:Get (in: This=0x6cc5e8, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2348ab4*=0, plFlavor=0x2348ab8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2348ab4*=8, plFlavor=0x2348ab8*=0) returned 0x0 [0321.714] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0321.714] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0321.714] IWbemClassObject:Get (in: This=0x6cc5e8, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2348ab4*=8, plFlavor=0x2348ab8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2348ab4*=8, plFlavor=0x2348ab8*=0) returned 0x0 [0321.714] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0321.714] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0321.715] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0321.715] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x6ca938, puReturned=0x2320524*=0x1) returned 0x0 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6ca938) returned 0x0 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.717] IUnknown:AddRef (This=0x6ca938) returned 0x3 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.717] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6ca93c) returned 0x0 [0321.717] IMarshal:GetUnmarshalClass (in: This=0x6ca93c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.718] IUnknown:Release (This=0x6ca93c) returned 0x3 [0321.718] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.718] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.718] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.718] IUnknown:Release (This=0x6ca938) returned 0x2 [0321.718] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.718] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.718] IUnknown:QueryInterface (in: This=0x6ca938, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6ca938) returned 0x0 [0321.718] IUnknown:AddRef (This=0x6ca938) returned 0x4 [0321.718] IUnknown:Release (This=0x6ca938) returned 0x3 [0321.718] IUnknown:Release (This=0x6ca938) returned 0x2 [0321.718] CoTaskMemFree (pv=0x586b170) [0321.718] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.719] IUnknown:AddRef (This=0x6ca938) returned 0x3 [0321.719] IWbemClassObject:Get (in: This=0x6ca938, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.719] IWbemClassObject:Get (in: This=0x6ca938, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.720] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0321.720] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0321.720] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.720] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.720] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.720] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.722] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b150) returned 0x0 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b150, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.722] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b150, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x5872ff0) returned 0x0 [0321.722] WbemDefPath:IUnknown:Release (This=0x586b150) returned 0x0 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x5872ff0) returned 0x0 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.722] WbemDefPath:IUnknown:AddRef (This=0x5872ff0) returned 0x3 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.722] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58ca3e8) returned 0x0 [0321.723] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58ca3e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.723] WbemDefPath:IUnknown:Release (This=0x58ca3e8) returned 0x3 [0321.723] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.723] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.723] WbemDefPath:IUnknown:Release (This=0x5872ff0) returned 0x2 [0321.723] WbemDefPath:IUnknown:Release (This=0x5872ff0) returned 0x1 [0321.723] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.723] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ff0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x5872ff0) returned 0x0 [0321.723] WbemDefPath:IUnknown:AddRef (This=0x5872ff0) returned 0x3 [0321.723] WbemDefPath:IUnknown:Release (This=0x5872ff0) returned 0x2 [0321.724] WbemDefPath:IWbemPath:SetText (This=0x5872ff0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.724] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.724] IWbemClassObject:Get (in: This=0x6ca938, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2349348*=0, plFlavor=0x234934c*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x2349348*=8, plFlavor=0x234934c*=0) returned 0x0 [0321.724] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0321.724] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0321.724] IWbemClassObject:Get (in: This=0x6ca938, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2349348*=8, plFlavor=0x234934c*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x2349348*=8, plFlavor=0x234934c*=0) returned 0x0 [0321.724] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0321.724] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0321.725] CoTaskMemAlloc (cb=0x4) returned 0x586b170 [0321.725] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b170, puReturned=0x2320524 | out: apObjects=0x586b170*=0x6cb790, puReturned=0x2320524*=0x1) returned 0x0 [0321.733] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e170 | out: ppvObject=0x18e170*=0x6cb790) returned 0x0 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18dd24 | out: ppvObject=0x18dd24*=0x0) returned 0x80004002 [0321.734] IUnknown:AddRef (This=0x6cb790) returned 0x3 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18da84 | out: ppvObject=0x18da84*=0x0) returned 0x80004002 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18da34 | out: ppvObject=0x18da34*=0x0) returned 0x80004002 [0321.734] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18da40 | out: ppvObject=0x18da40*=0x6cb794) returned 0x0 [0321.734] IMarshal:GetUnmarshalClass (in: This=0x6cb794, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18da48 | out: pCid=0x18da48*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0321.735] IUnknown:Release (This=0x6cb794) returned 0x3 [0321.735] CoGetContextToken (in: pToken=0x18daa0 | out: pToken=0x18daa0) returned 0x0 [0321.735] CoGetContextToken (in: pToken=0x18dea8 | out: pToken=0x18dea8) returned 0x0 [0321.735] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df34 | out: ppvObject=0x18df34*=0x0) returned 0x80004002 [0321.735] IUnknown:Release (This=0x6cb790) returned 0x2 [0321.735] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0321.735] CoGetContextToken (in: pToken=0x18e3e0 | out: pToken=0x18e3e0) returned 0x0 [0321.735] IUnknown:QueryInterface (in: This=0x6cb790, riid=0x18e4b0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e4ac | out: ppvObject=0x18e4ac*=0x6cb790) returned 0x0 [0321.735] IUnknown:AddRef (This=0x6cb790) returned 0x4 [0321.735] IUnknown:Release (This=0x6cb790) returned 0x3 [0321.735] IUnknown:Release (This=0x6cb790) returned 0x2 [0321.735] CoTaskMemFree (pv=0x586b170) [0321.735] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0321.736] IUnknown:AddRef (This=0x6cb790) returned 0x3 [0321.736] IWbemClassObject:Get (in: This=0x6cb790, wszName="__GENUS", lFlags=0, pVal=0x18eb08*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb88*=0, plFlavor=0x18eb84*=0 | out: pVal=0x18eb08*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18eb88*=3, plFlavor=0x18eb84*=64) returned 0x0 [0321.736] IWbemClassObject:Get (in: This=0x6cb790, wszName="__PATH", lFlags=0, pVal=0x18eaec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18eb70*=0, plFlavor=0x18eb6c*=0 | out: pVal=0x18eaec*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"", varVal2=0x0), pType=0x18eb70*=8, plFlavor=0x18eb6c*=64) returned 0x0 [0321.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0321.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0321.736] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb18 | out: ppv=0x18eb18*=0x692bc4) returned 0x0 [0321.736] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb10 | out: pAptType=0x18eb10*=1) returned 0x0 [0321.737] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb14 | out: ppvObject=0x18eb14*=0x0) returned 0x80004002 [0321.737] IUnknown:Release (This=0x692bc4) returned 0x1 [0321.738] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e480 | out: ppv=0x18e480*=0x586b230) returned 0x0 [0321.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b230, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e69c | out: ppvObject=0x18e69c*=0x0) returned 0x80004002 [0321.738] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b230, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6a8 | out: ppvObject=0x18e6a8*=0x58727a0) returned 0x0 [0321.738] WbemDefPath:IUnknown:Release (This=0x586b230) returned 0x0 [0321.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2cc | out: ppvObject=0x18e2cc*=0x58727a0) returned 0x0 [0321.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e288 | out: ppvObject=0x18e288*=0x0) returned 0x80004002 [0321.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0321.739] WbemDefPath:IUnknown:AddRef (This=0x58727a0) returned 0x3 [0321.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dbdc | out: ppvObject=0x18dbdc*=0x0) returned 0x80004002 [0321.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18db8c | out: ppvObject=0x18db8c*=0x0) returned 0x80004002 [0321.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18db98 | out: ppvObject=0x18db98*=0x58ca340) returned 0x0 [0321.739] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58ca340, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dba0 | out: pCid=0x18dba0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0321.739] WbemDefPath:IUnknown:Release (This=0x58ca340) returned 0x3 [0321.739] CoGetContextToken (in: pToken=0x18dbf8 | out: pToken=0x18dbf8) returned 0x0 [0321.739] CoGetContextToken (in: pToken=0x18e000 | out: pToken=0x18e000) returned 0x0 [0321.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e08c | out: ppvObject=0x18e08c*=0x0) returned 0x80004002 [0321.739] WbemDefPath:IUnknown:Release (This=0x58727a0) returned 0x2 [0321.739] WbemDefPath:IUnknown:Release (This=0x58727a0) returned 0x1 [0321.740] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0321.740] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0321.740] WbemDefPath:IUnknown:QueryInterface (in: This=0x58727a0, riid=0x18e9c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x58727a0) returned 0x0 [0321.740] WbemDefPath:IUnknown:AddRef (This=0x58727a0) returned 0x3 [0321.740] WbemDefPath:IUnknown:Release (This=0x58727a0) returned 0x2 [0321.740] WbemDefPath:IWbemPath:SetText (This=0x58727a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb44 | out: puCount=0x18eb44*=0x2) returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0x0, pszText=0x0 | out: puBuffLength=0x18eb40*=0xf, pszText=0x0) returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb10 | out: puCount=0x18eb10*=0x2) returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0x0, pszText=0x0 | out: puBuffLength=0x18eb0c*=0xf, pszText=0x0) returned 0x0 [0321.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eb0c*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb0c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0321.740] IWbemClassObject:Get (in: This=0x6cb790, wszName="Name", lFlags=0, pVal=0x18eb0c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2349bd4*=0, plFlavor=0x2349bd8*=0 | out: pVal=0x18eb0c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x2349bd4*=8, plFlavor=0x2349bd8*=0) returned 0x0 [0321.740] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0321.741] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0321.741] IWbemClassObject:Get (in: This=0x6cb790, wszName="Name", lFlags=0, pVal=0x18eb14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2349bd4*=8, plFlavor=0x2349bd8*=0 | out: pVal=0x18eb14*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x2349bd4*=8, plFlavor=0x2349bd8*=0) returned 0x0 [0321.741] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0321.741] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0321.741] CoTaskMemAlloc (cb=0x4) returned 0x586b130 [0321.741] IEnumWbemClassObject:Next (in: This=0x73be10, lTimeout=-1, uCount=0x1, apObjects=0x586b130, puReturned=0x2320524 | out: apObjects=0x586b130*=0x0, puReturned=0x2320524*=0x0) returned 0x1 [0321.742] CoTaskMemFree (pv=0x586b130) [0321.743] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0321.743] WbemLocator:IUnknown:Release (This=0x6c2508) returned 0x1 [0321.743] IUnknown:Release (This=0x73be10) returned 0x0 [0321.745] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0321.745] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x1 [0321.745] IUnknown:Release (This=0x73c900) returned 0x0 [0321.791] CoTaskMemAlloc (cb=0x20c) returned 0x690b38 [0321.791] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x690b38 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0321.798] CoTaskMemFree (pv=0x690b38) [0321.799] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0321.799] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x26, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0321.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba0) returned 1 [0321.804] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0321.804] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0321.807] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\tdata\\*"), lpFindFileData=0x18e8c8 | out: lpFindFileData=0x18e8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0321.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb64) returned 1 [0321.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0321.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0321.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ebf4) returned 1 [0321.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0321.821] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0321.821] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\telegram desktop\\tdata\\*"), lpFindFileData=0x18e91c | out: lpFindFileData=0x18e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0321.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ebb8) returned 1 [0323.004] CoTaskMemAlloc (cb=0x20c) returned 0x690b38 [0323.004] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x690b38 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0323.004] CoTaskMemFree (pv=0x690b38) [0323.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0323.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x24, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0323.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPEntity12N", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0323.004] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPEntity12N", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPEntity12N", lpFilePart=0x0) returned 0x33 [0323.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb84) returned 1 [0323.005] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NordVPEntity12N" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nordvpentity12n"), fInfoLevelId=0x0, lpFileInformation=0x234bacc | out: lpFileInformation=0x234bacc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0323.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb80) returned 1 [0323.121] ExpandEnvironmentStringsW (in: lpSrc="%USERPFile.WriteROFILE%", lpDst=0x18eaa4, nSize=0x64 | out: lpDst="%USERPFile.WriteROFILE%") returned 0x18 [0323.121] ExpandEnvironmentStringsW (in: lpSrc="%USERPFile.WriteROFILE%\\AppFile.WriteData\\RoamiFile.Writeng", lpDst=0x18eaa4, nSize=0x64 | out: lpDst="%USERPFile.WriteROFILE%\\AppFile.WriteData\\RoamiFile.Writeng") returned 0x3c [0323.320] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0323.320] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x55, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", lpFilePart=0x0) returned 0x54 [0323.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ebec) returned 1 [0323.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0323.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", nBufferLength=0x55, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles", lpFilePart=0x0) returned 0x54 [0323.321] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Roaming\\OpenVPN Connect\\profiles\\*ovpn" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c:\\users\\rdhj0cnfevzx"), lpFindFileData=0x18e914 | out: lpFindFileData=0x18e914*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0323.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ebb0) returned 1 [0323.380] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%", lpDst=0x18eab0, nSize=0x64 | out: lpDst="%USERPserviceInterface.ExtensionROFILE%") returned 0x28 [0323.381] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl", lpDst=0x18eab0, nSize=0x64 | out: lpDst="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Exte\x18墐") returned 0x6a [0323.381] ExpandEnvironmentStringsW (in: lpSrc="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl", lpDst=0x18eaa4, nSize=0x6a | out: lpDst="%USERPserviceInterface.ExtensionROFILE%\\ApserviceInterface.ExtensionpData\\LocaserviceInterface.Extensionl") returned 0x6a [0323.382] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0323.382] GetFullPathNameW (in: lpFileName="%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", lpFilePart=0x0) returned 0x43 [0323.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ebec) returned 1 [0323.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0323.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN", lpFilePart=0x0) returned 0x43 [0323.383] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\%USERPROFILE%\\AppData\\Local\\ProtonVPN\\*ovpn" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\c:\\users\\rdhj0cnfevzx"), lpFindFileData=0x18e914 | out: lpFindFileData=0x18e914*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0323.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ebb0) returned 1 [0323.654] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0323.654] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0323.654] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0323.655] IUnknown:Release (This=0x692bc4) returned 0x1 [0323.656] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b0c0) returned 0x0 [0323.656] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b0c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0323.657] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b0c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872f80) returned 0x0 [0323.657] WbemDefPath:IUnknown:Release (This=0x586b0c0) returned 0x0 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872f80) returned 0x0 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0323.657] WbemDefPath:IUnknown:AddRef (This=0x5872f80) returned 0x3 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0323.657] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58ca568) returned 0x0 [0323.658] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58ca568, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0323.658] WbemDefPath:IUnknown:Release (This=0x58ca568) returned 0x3 [0323.658] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0323.658] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0323.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0323.658] WbemDefPath:IUnknown:Release (This=0x5872f80) returned 0x2 [0323.658] WbemDefPath:IUnknown:Release (This=0x5872f80) returned 0x1 [0323.658] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0323.658] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0323.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872f80, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872f80) returned 0x0 [0323.658] WbemDefPath:IUnknown:AddRef (This=0x5872f80) returned 0x3 [0323.659] WbemDefPath:IUnknown:Release (This=0x5872f80) returned 0x2 [0323.659] WbemDefPath:IWbemPath:SetText (This=0x5872f80, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872f80, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x18, pszText=0x0) returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18ebe0*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebe0*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872f80, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x18, pszText=0x0) returned 0x0 [0323.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18ebcc*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebcc*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0323.659] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0323.659] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0323.660] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0323.660] IUnknown:Release (This=0x692bc4) returned 0x1 [0323.661] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58ca928) returned 0x0 [0323.661] WbemLocator:IUnknown:QueryInterface (in: This=0x58ca928, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0323.661] WbemLocator:IClassFactory:CreateInstance (in: This=0x58ca928, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b200) returned 0x0 [0323.661] WbemLocator:IUnknown:Release (This=0x58ca928) returned 0x0 [0323.662] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b200) returned 0x0 [0323.662] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0323.662] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0323.663] WbemLocator:IUnknown:AddRef (This=0x586b200) returned 0x3 [0323.663] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0323.663] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0323.663] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0323.663] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0323.663] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0323.663] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0323.663] WbemLocator:IUnknown:Release (This=0x586b200) returned 0x2 [0323.663] WbemLocator:IUnknown:Release (This=0x586b200) returned 0x1 [0323.664] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0323.664] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0323.664] WbemLocator:IUnknown:QueryInterface (in: This=0x586b200, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b200) returned 0x0 [0323.664] WbemLocator:IUnknown:AddRef (This=0x586b200) returned 0x3 [0323.664] WbemLocator:IUnknown:Release (This=0x586b200) returned 0x2 [0323.664] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872f80, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0323.664] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x18, pszText=0x0) returned 0x0 [0323.664] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=8, puBuffLength=0x18eb38*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb38*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0323.664] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b220) returned 0x0 [0323.665] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b220, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x58bca18) returned 0x0 [0324.070] WbemLocator:IUnknown:QueryInterface (in: This=0x58bca18, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c26e4) returned 0x0 [0324.070] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c26e4, pProxy=0x58bca18, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0324.071] WbemLocator:IUnknown:Release (This=0x6c26e4) returned 0x1 [0324.071] WbemLocator:IUnknown:QueryInterface (in: This=0x58bca18, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c2708) returned 0x0 [0324.071] WbemLocator:IUnknown:QueryInterface (in: This=0x58bca18, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c26e4) returned 0x0 [0324.071] WbemLocator:IClientSecurity:SetBlanket (This=0x6c26e4, pProxy=0x58bca18, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.071] WbemLocator:IUnknown:Release (This=0x6c26e4) returned 0x2 [0324.071] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x1 [0324.071] CoTaskMemFree (pv=0x6be2e8) [0324.072] WbemLocator:IUnknown:Release (This=0x586b220) returned 0x0 [0324.072] WbemLocator:IUnknown:QueryInterface (in: This=0x58bca18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c2708) returned 0x0 [0324.072] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0324.077] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0324.078] WbemLocator:IUnknown:QueryInterface (in: This=0x58bca18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0324.083] WbemLocator:IUnknown:AddRef (This=0x6c2708) returned 0x3 [0324.083] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0324.083] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0324.083] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c2664) returned 0x0 [0324.083] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2664, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.084] WbemLocator:IUnknown:Release (This=0x6c2664) returned 0x3 [0324.084] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0324.084] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0324.084] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c26ec) returned 0x0 [0324.084] WbemLocator:IRpcOptions:Query (in: This=0x6c26ec, pPrx=0x6c2708, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0324.084] WbemLocator:IUnknown:Release (This=0x6c26ec) returned 0x3 [0324.085] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x2 [0324.085] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0324.085] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0324.085] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x58bca18) returned 0x0 [0324.085] WbemLocator:IUnknown:AddRef (This=0x58bca18) returned 0x4 [0324.085] WbemLocator:IUnknown:Release (This=0x58bca18) returned 0x3 [0324.085] WbemLocator:IUnknown:Release (This=0x58bca18) returned 0x2 [0324.085] SysStringLen (param_1=0x0) returned 0x0 [0324.085] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0324.086] WbemLocator:IUnknown:AddRef (This=0x6c2708) returned 0x3 [0324.086] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c2708) returned 0x0 [0324.086] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x3 [0324.086] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x2 [0324.086] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0324.086] WbemLocator:IUnknown:AddRef (This=0x58bca18) returned 0x3 [0324.086] IWbemServices:ExecQuery (in: This=0x58bca18, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73c770) returned 0x0 [0324.140] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x73c774) returned 0x0 [0324.141] IClientSecurity:QueryBlanket (in: This=0x73c774, pProxy=0x73c770, pAuthnSvc=0x18e9f4, pAuthzSvc=0x18e9f0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec, pImpLevel=0x18e9dc, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4 | out: pAuthnSvc=0x18e9f4*=0xa, pAuthzSvc=0x18e9f0*=0x0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec*=0x6, pImpLevel=0x18e9dc*=0x2, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4*=0x1) returned 0x0 [0324.141] IUnknown:Release (This=0x73c774) returned 0x1 [0324.141] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x6c1f08) returned 0x0 [0324.141] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x73c774) returned 0x0 [0324.141] IClientSecurity:SetBlanket (This=0x73c774, pProxy=0x73c770, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.144] IUnknown:Release (This=0x73c774) returned 0x2 [0324.144] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x1 [0324.145] CoTaskMemFree (pv=0x586ed40) [0324.145] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x6c1f08) returned 0x0 [0324.145] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e54c | out: ppvObject=0x18e54c*=0x0) returned 0x80004002 [0324.146] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x0) returned 0x80004002 [0324.147] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e144 | out: ppvObject=0x18e144*=0x0) returned 0x80004002 [0324.148] WbemLocator:IUnknown:AddRef (This=0x6c1f08) returned 0x3 [0324.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dea4 | out: ppvObject=0x18dea4*=0x0) returned 0x80004002 [0324.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de54 | out: ppvObject=0x18de54*=0x0) returned 0x80004002 [0324.148] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de60 | out: ppvObject=0x18de60*=0x6c1e64) returned 0x0 [0324.149] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1e64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de68 | out: pCid=0x18de68*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.149] WbemLocator:IUnknown:Release (This=0x6c1e64) returned 0x3 [0324.149] CoGetContextToken (in: pToken=0x18dec0 | out: pToken=0x18dec0) returned 0x0 [0324.149] CoGetContextToken (in: pToken=0x18e2c8 | out: pToken=0x18e2c8) returned 0x0 [0324.149] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x6c1eec) returned 0x0 [0324.149] WbemLocator:IRpcOptions:Query (in: This=0x6c1eec, pPrx=0x6c1f08, dwProperty=2, pdwValue=0x18e360 | out: pdwValue=0x18e360) returned 0x80004002 [0324.149] WbemLocator:IUnknown:Release (This=0x6c1eec) returned 0x3 [0324.149] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x2 [0324.149] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0324.150] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0324.150] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73c770) returned 0x0 [0324.150] IUnknown:AddRef (This=0x73c770) returned 0x4 [0324.150] IUnknown:Release (This=0x73c770) returned 0x3 [0324.150] IUnknown:Release (This=0x73c770) returned 0x2 [0324.150] WbemLocator:IUnknown:Release (This=0x58bca18) returned 0x2 [0324.150] SysStringLen (param_1=0x0) returned 0x0 [0324.150] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872f80, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0324.150] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x18, pszText=0x0) returned 0x0 [0324.150] WbemDefPath:IWbemPath:GetText (in: This=0x5872f80, lFlags=4, puBuffLength=0x18eb90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.150] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0324.151] IUnknown:AddRef (This=0x73c770) returned 0x3 [0324.151] IEnumWbemClassObject:Clone (in: This=0x73c770, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73c068) returned 0x0 [0324.153] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73c06c) returned 0x0 [0324.153] IClientSecurity:QueryBlanket (in: This=0x73c06c, pProxy=0x73c068, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0324.153] IUnknown:Release (This=0x73c06c) returned 0x1 [0324.153] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c1808) returned 0x0 [0324.153] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73c06c) returned 0x0 [0324.153] IClientSecurity:SetBlanket (This=0x73c06c, pProxy=0x73c068, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.229] IUnknown:Release (This=0x73c06c) returned 0x2 [0324.229] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0324.229] CoTaskMemFree (pv=0x586eda0) [0324.230] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c1808) returned 0x0 [0324.230] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0324.231] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0324.231] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0324.232] WbemLocator:IUnknown:AddRef (This=0x6c1808) returned 0x3 [0324.232] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0324.232] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0324.232] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c1764) returned 0x0 [0324.233] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1764, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.233] WbemLocator:IUnknown:Release (This=0x6c1764) returned 0x3 [0324.233] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0324.233] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0324.233] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c17ec) returned 0x0 [0324.233] WbemLocator:IRpcOptions:Query (in: This=0x6c17ec, pPrx=0x6c1808, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0324.233] WbemLocator:IUnknown:Release (This=0x6c17ec) returned 0x3 [0324.233] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x2 [0324.233] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0324.233] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0324.233] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73c068) returned 0x0 [0324.233] IUnknown:AddRef (This=0x73c068) returned 0x4 [0324.234] IUnknown:Release (This=0x73c068) returned 0x3 [0324.234] IUnknown:Release (This=0x73c068) returned 0x2 [0324.234] IUnknown:Release (This=0x73c770) returned 0x2 [0324.234] SysStringLen (param_1=0x0) returned 0x0 [0324.234] IEnumWbemClassObject:Reset (This=0x73c068) returned 0x0 [0324.235] CoTaskMemAlloc (cb=0x4) returned 0x586b410 [0324.235] IEnumWbemClassObject:Next (in: This=0x73c068, lTimeout=-1, uCount=0x1, apObjects=0x586b410, puReturned=0x234f868 | out: apObjects=0x586b410*=0x0, puReturned=0x234f868*=0x0) returned 0x1 [0324.308] CoTaskMemFree (pv=0x586b410) [0324.308] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.308] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0324.308] IUnknown:Release (This=0x73c068) returned 0x0 [0324.310] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.310] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x1 [0324.311] IUnknown:Release (This=0x73c770) returned 0x0 [0324.312] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0324.313] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0324.313] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0324.313] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.314] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0324.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0324.315] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872ce0) returned 0x0 [0324.315] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0324.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872ce0) returned 0x0 [0324.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0324.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0324.315] WbemDefPath:IUnknown:AddRef (This=0x5872ce0) returned 0x3 [0324.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0324.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0324.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58ca940) returned 0x0 [0324.316] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58ca940, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.316] WbemDefPath:IUnknown:Release (This=0x58ca940) returned 0x3 [0324.316] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0324.316] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0324.316] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0324.316] WbemDefPath:IUnknown:Release (This=0x5872ce0) returned 0x2 [0324.316] WbemDefPath:IUnknown:Release (This=0x5872ce0) returned 0x1 [0324.316] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0324.316] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0324.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872ce0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872ce0) returned 0x0 [0324.317] WbemDefPath:IUnknown:AddRef (This=0x5872ce0) returned 0x3 [0324.317] WbemDefPath:IUnknown:Release (This=0x5872ce0) returned 0x2 [0324.317] WbemDefPath:IWbemPath:SetText (This=0x5872ce0, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872ce0, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x18, pszText=0x0) returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18ebe0*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebe0*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872ce0, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x18, pszText=0x0) returned 0x0 [0324.317] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18ebcc*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebcc*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.317] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0324.317] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0324.318] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0324.318] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.319] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58ca808) returned 0x0 [0324.319] WbemLocator:IUnknown:QueryInterface (in: This=0x58ca808, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0324.319] WbemLocator:IClassFactory:CreateInstance (in: This=0x58ca808, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b390) returned 0x0 [0324.319] WbemLocator:IUnknown:Release (This=0x58ca808) returned 0x0 [0324.319] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b390) returned 0x0 [0324.319] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0324.319] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0324.319] WbemLocator:IUnknown:AddRef (This=0x586b390) returned 0x3 [0324.319] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0324.320] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0324.320] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0324.320] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0324.320] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0324.320] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0324.320] WbemLocator:IUnknown:Release (This=0x586b390) returned 0x2 [0324.320] WbemLocator:IUnknown:Release (This=0x586b390) returned 0x1 [0324.320] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0324.320] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0324.320] WbemLocator:IUnknown:QueryInterface (in: This=0x586b390, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b390) returned 0x0 [0324.320] WbemLocator:IUnknown:AddRef (This=0x586b390) returned 0x3 [0324.320] WbemLocator:IUnknown:Release (This=0x586b390) returned 0x2 [0324.320] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872ce0, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0324.321] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x18, pszText=0x0) returned 0x0 [0324.321] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=8, puBuffLength=0x18eb38*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb38*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.321] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b470) returned 0x0 [0324.321] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b470, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x587eeb0) returned 0x0 [0324.464] WbemLocator:IUnknown:QueryInterface (in: This=0x587eeb0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c14e4) returned 0x0 [0324.465] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c14e4, pProxy=0x587eeb0, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0324.465] WbemLocator:IUnknown:Release (This=0x6c14e4) returned 0x1 [0324.465] WbemLocator:IUnknown:QueryInterface (in: This=0x587eeb0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c1508) returned 0x0 [0324.465] WbemLocator:IUnknown:QueryInterface (in: This=0x587eeb0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c14e4) returned 0x0 [0324.465] WbemLocator:IClientSecurity:SetBlanket (This=0x6c14e4, pProxy=0x587eeb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.465] WbemLocator:IUnknown:Release (This=0x6c14e4) returned 0x2 [0324.465] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x1 [0324.465] CoTaskMemFree (pv=0x586ed70) [0324.466] WbemLocator:IUnknown:Release (This=0x586b470) returned 0x0 [0324.466] WbemLocator:IUnknown:QueryInterface (in: This=0x587eeb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c1508) returned 0x0 [0324.466] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0324.476] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0324.480] WbemLocator:IUnknown:QueryInterface (in: This=0x587eeb0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0324.487] WbemLocator:IUnknown:AddRef (This=0x6c1508) returned 0x3 [0324.487] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0324.487] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0324.487] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c1464) returned 0x0 [0324.488] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1464, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.488] WbemLocator:IUnknown:Release (This=0x6c1464) returned 0x3 [0324.488] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0324.488] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0324.488] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c14ec) returned 0x0 [0324.488] WbemLocator:IRpcOptions:Query (in: This=0x6c14ec, pPrx=0x6c1508, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0324.488] WbemLocator:IUnknown:Release (This=0x6c14ec) returned 0x3 [0324.489] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x2 [0324.489] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0324.489] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0324.489] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x587eeb0) returned 0x0 [0324.489] WbemLocator:IUnknown:AddRef (This=0x587eeb0) returned 0x4 [0324.489] WbemLocator:IUnknown:Release (This=0x587eeb0) returned 0x3 [0324.489] WbemLocator:IUnknown:Release (This=0x587eeb0) returned 0x2 [0324.489] SysStringLen (param_1=0x0) returned 0x0 [0324.489] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0324.489] WbemLocator:IUnknown:AddRef (This=0x6c1508) returned 0x3 [0324.489] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c1508) returned 0x0 [0324.489] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x3 [0324.489] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x2 [0324.489] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0324.489] WbemLocator:IUnknown:AddRef (This=0x587eeb0) returned 0x3 [0324.490] IWbemServices:ExecQuery (in: This=0x587eeb0, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73c770) returned 0x0 [0324.523] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a0 | out: ppvObject=0x18e9a0*=0x73c774) returned 0x0 [0324.523] IClientSecurity:QueryBlanket (in: This=0x73c774, pProxy=0x73c770, pAuthnSvc=0x18e9f0, pAuthzSvc=0x18e9ec, pServerPrincName=0x18e9e4, pAuthnLevel=0x18e9e8, pImpLevel=0x18e9d8, pAuthInfo=0x18e9dc, pCapabilites=0x18e9e0 | out: pAuthnSvc=0x18e9f0*=0xa, pAuthzSvc=0x18e9ec*=0x0, pServerPrincName=0x18e9e4, pAuthnLevel=0x18e9e8*=0x6, pImpLevel=0x18e9d8*=0x2, pAuthInfo=0x18e9dc, pCapabilites=0x18e9e0*=0x1) returned 0x0 [0324.523] IUnknown:Release (This=0x73c774) returned 0x1 [0324.523] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0x6c2908) returned 0x0 [0324.523] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e980 | out: ppvObject=0x18e980*=0x73c774) returned 0x0 [0324.523] IClientSecurity:SetBlanket (This=0x73c774, pProxy=0x73c770, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.527] IUnknown:Release (This=0x73c774) returned 0x2 [0324.527] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0324.527] CoTaskMemFree (pv=0x586eda0) [0324.528] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e58c | out: ppvObject=0x18e58c*=0x6c2908) returned 0x0 [0324.529] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e548 | out: ppvObject=0x18e548*=0x0) returned 0x80004002 [0324.529] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e364 | out: ppvObject=0x18e364*=0x0) returned 0x80004002 [0324.530] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e13c | out: ppvObject=0x18e13c*=0x0) returned 0x80004002 [0324.531] WbemLocator:IUnknown:AddRef (This=0x6c2908) returned 0x3 [0324.531] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de9c | out: ppvObject=0x18de9c*=0x0) returned 0x80004002 [0324.531] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de4c | out: ppvObject=0x18de4c*=0x0) returned 0x80004002 [0324.531] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de58 | out: ppvObject=0x18de58*=0x6c2864) returned 0x0 [0324.531] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de60 | out: pCid=0x18de60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.531] WbemLocator:IUnknown:Release (This=0x6c2864) returned 0x3 [0324.531] CoGetContextToken (in: pToken=0x18deb8 | out: pToken=0x18deb8) returned 0x0 [0324.532] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0324.532] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0x6c28ec) returned 0x0 [0324.532] WbemLocator:IRpcOptions:Query (in: This=0x6c28ec, pPrx=0x6c2908, dwProperty=2, pdwValue=0x18e358 | out: pdwValue=0x18e358) returned 0x80004002 [0324.532] WbemLocator:IUnknown:Release (This=0x6c28ec) returned 0x3 [0324.532] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x2 [0324.532] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0324.532] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0324.532] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73c770) returned 0x0 [0324.532] IUnknown:AddRef (This=0x73c770) returned 0x4 [0324.532] IUnknown:Release (This=0x73c770) returned 0x3 [0324.532] IUnknown:Release (This=0x73c770) returned 0x2 [0324.532] WbemLocator:IUnknown:Release (This=0x587eeb0) returned 0x2 [0324.532] SysStringLen (param_1=0x0) returned 0x0 [0324.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872ce0, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0324.533] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x18, pszText=0x0) returned 0x0 [0324.533] WbemDefPath:IWbemPath:GetText (in: This=0x5872ce0, lFlags=4, puBuffLength=0x18eb90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.533] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0324.533] IUnknown:AddRef (This=0x73c770) returned 0x3 [0324.533] IEnumWbemClassObject:Clone (in: This=0x73c770, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73bd48) returned 0x0 [0324.535] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73bd4c) returned 0x0 [0324.535] IClientSecurity:QueryBlanket (in: This=0x73bd4c, pProxy=0x73bd48, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0324.535] IUnknown:Release (This=0x73bd4c) returned 0x1 [0324.535] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c2e08) returned 0x0 [0324.535] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73bd4c) returned 0x0 [0324.535] IClientSecurity:SetBlanket (This=0x73bd4c, pProxy=0x73bd48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.632] IUnknown:Release (This=0x73bd4c) returned 0x2 [0324.632] WbemLocator:IUnknown:Release (This=0x6c2e08) returned 0x1 [0324.633] CoTaskMemFree (pv=0x586eda0) [0324.633] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c2e08) returned 0x0 [0324.633] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0324.634] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0324.635] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0324.636] WbemLocator:IUnknown:AddRef (This=0x6c2e08) returned 0x3 [0324.636] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0324.636] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0324.636] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c2d64) returned 0x0 [0324.637] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2d64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.637] WbemLocator:IUnknown:Release (This=0x6c2d64) returned 0x3 [0324.637] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0324.637] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0324.637] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c2dec) returned 0x0 [0324.637] WbemLocator:IRpcOptions:Query (in: This=0x6c2dec, pPrx=0x6c2e08, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0324.637] WbemLocator:IUnknown:Release (This=0x6c2dec) returned 0x3 [0324.638] WbemLocator:IUnknown:Release (This=0x6c2e08) returned 0x2 [0324.638] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0324.638] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0324.638] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2e08, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73bd48) returned 0x0 [0324.638] IUnknown:AddRef (This=0x73bd48) returned 0x4 [0324.638] IUnknown:Release (This=0x73bd48) returned 0x3 [0324.638] IUnknown:Release (This=0x73bd48) returned 0x2 [0324.638] IUnknown:Release (This=0x73c770) returned 0x2 [0324.638] SysStringLen (param_1=0x0) returned 0x0 [0324.638] IEnumWbemClassObject:Reset (This=0x73bd48) returned 0x0 [0324.639] CoTaskMemAlloc (cb=0x4) returned 0x586b430 [0324.640] IEnumWbemClassObject:Next (in: This=0x73bd48, lTimeout=-1, uCount=0x1, apObjects=0x586b430, puReturned=0x235091c | out: apObjects=0x586b430*=0x0, puReturned=0x235091c*=0x0) returned 0x1 [0324.641] CoTaskMemFree (pv=0x586b430) [0324.641] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.641] WbemLocator:IUnknown:Release (This=0x6c2e08) returned 0x1 [0324.641] IUnknown:Release (This=0x73bd48) returned 0x0 [0324.643] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.643] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0324.643] IUnknown:Release (This=0x73c770) returned 0x0 [0324.649] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0324.649] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0324.649] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0324.649] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.651] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b310) returned 0x0 [0324.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0324.651] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b310, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872810) returned 0x0 [0324.651] WbemDefPath:IUnknown:Release (This=0x586b310) returned 0x0 [0324.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872810) returned 0x0 [0324.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0324.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0324.652] WbemDefPath:IUnknown:AddRef (This=0x5872810) returned 0x3 [0324.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0324.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0324.652] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58ca850) returned 0x0 [0324.653] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58ca850, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.653] WbemDefPath:IUnknown:Release (This=0x58ca850) returned 0x3 [0324.653] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0324.654] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0324.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0324.654] WbemDefPath:IUnknown:Release (This=0x5872810) returned 0x2 [0324.654] WbemDefPath:IUnknown:Release (This=0x5872810) returned 0x1 [0324.654] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0324.654] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0324.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872810, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872810) returned 0x0 [0324.655] WbemDefPath:IUnknown:AddRef (This=0x5872810) returned 0x3 [0324.655] WbemDefPath:IUnknown:Release (This=0x5872810) returned 0x2 [0324.655] WbemDefPath:IWbemPath:SetText (This=0x5872810, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872810, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x18, pszText=0x0) returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18ebe0*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebe0*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872810, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x18, pszText=0x0) returned 0x0 [0324.655] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18ebcc*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18ebcc*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.655] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0324.655] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0324.656] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0324.656] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.657] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58caa30) returned 0x0 [0324.657] WbemLocator:IUnknown:QueryInterface (in: This=0x58caa30, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0324.657] WbemLocator:IClassFactory:CreateInstance (in: This=0x58caa30, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b4b0) returned 0x0 [0324.657] WbemLocator:IUnknown:Release (This=0x58caa30) returned 0x0 [0324.657] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b4b0) returned 0x0 [0324.657] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0324.657] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0324.658] WbemLocator:IUnknown:AddRef (This=0x586b4b0) returned 0x3 [0324.658] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0324.658] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0324.658] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0324.658] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0324.658] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0324.658] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0324.658] WbemLocator:IUnknown:Release (This=0x586b4b0) returned 0x2 [0324.658] WbemLocator:IUnknown:Release (This=0x586b4b0) returned 0x1 [0324.659] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0324.659] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0324.659] WbemLocator:IUnknown:QueryInterface (in: This=0x586b4b0, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b4b0) returned 0x0 [0324.659] WbemLocator:IUnknown:AddRef (This=0x586b4b0) returned 0x3 [0324.659] WbemLocator:IUnknown:Release (This=0x586b4b0) returned 0x2 [0324.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872810, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0324.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x18, pszText=0x0) returned 0x0 [0324.659] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=8, puBuffLength=0x18eb38*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb38*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.659] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b3d0) returned 0x0 [0324.659] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b3d0, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x58c4f88) returned 0x0 [0324.722] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4f88, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c2ce4) returned 0x0 [0324.723] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c2ce4, pProxy=0x58c4f88, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0324.723] WbemLocator:IUnknown:Release (This=0x6c2ce4) returned 0x1 [0324.723] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4f88, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c2d08) returned 0x0 [0324.723] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4f88, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c2ce4) returned 0x0 [0324.723] WbemLocator:IClientSecurity:SetBlanket (This=0x6c2ce4, pProxy=0x58c4f88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.723] WbemLocator:IUnknown:Release (This=0x6c2ce4) returned 0x2 [0324.723] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x1 [0324.723] CoTaskMemFree (pv=0x586eda0) [0324.724] WbemLocator:IUnknown:Release (This=0x586b3d0) returned 0x0 [0324.724] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4f88, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c2d08) returned 0x0 [0324.724] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0324.725] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0324.727] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4f88, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0324.728] WbemLocator:IUnknown:AddRef (This=0x6c2d08) returned 0x3 [0324.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0324.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0324.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c2c64) returned 0x0 [0324.728] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2c64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.728] WbemLocator:IUnknown:Release (This=0x6c2c64) returned 0x3 [0324.728] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0324.729] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0324.729] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c2cec) returned 0x0 [0324.729] WbemLocator:IRpcOptions:Query (in: This=0x6c2cec, pPrx=0x6c2d08, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0324.729] WbemLocator:IUnknown:Release (This=0x6c2cec) returned 0x3 [0324.729] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x2 [0324.729] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0324.729] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0324.729] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x58c4f88) returned 0x0 [0324.729] WbemLocator:IUnknown:AddRef (This=0x58c4f88) returned 0x4 [0324.729] WbemLocator:IUnknown:Release (This=0x58c4f88) returned 0x3 [0324.729] WbemLocator:IUnknown:Release (This=0x58c4f88) returned 0x2 [0324.730] SysStringLen (param_1=0x0) returned 0x0 [0324.730] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0324.730] WbemLocator:IUnknown:AddRef (This=0x6c2d08) returned 0x3 [0324.730] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c2d08) returned 0x0 [0324.730] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x3 [0324.730] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x2 [0324.730] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0324.730] WbemLocator:IUnknown:AddRef (This=0x58c4f88) returned 0x3 [0324.730] IWbemServices:ExecQuery (in: This=0x58c4f88, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73c450) returned 0x0 [0324.768] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x73c454) returned 0x0 [0324.768] IClientSecurity:QueryBlanket (in: This=0x73c454, pProxy=0x73c450, pAuthnSvc=0x18e9f4, pAuthzSvc=0x18e9f0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec, pImpLevel=0x18e9dc, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4 | out: pAuthnSvc=0x18e9f4*=0xa, pAuthzSvc=0x18e9f0*=0x0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec*=0x6, pImpLevel=0x18e9dc*=0x2, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4*=0x1) returned 0x0 [0324.768] IUnknown:Release (This=0x73c454) returned 0x1 [0324.768] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x6c2908) returned 0x0 [0324.769] IUnknown:QueryInterface (in: This=0x73c450, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x73c454) returned 0x0 [0324.769] IClientSecurity:SetBlanket (This=0x73c454, pProxy=0x73c450, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.775] IUnknown:Release (This=0x73c454) returned 0x2 [0324.775] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0324.775] CoTaskMemFree (pv=0x586e9e0) [0324.776] IUnknown:QueryInterface (in: This=0x73c450, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x6c2908) returned 0x0 [0324.777] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e54c | out: ppvObject=0x18e54c*=0x0) returned 0x80004002 [0324.779] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x0) returned 0x80004002 [0324.780] IUnknown:QueryInterface (in: This=0x73c450, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e144 | out: ppvObject=0x18e144*=0x0) returned 0x80004002 [0324.782] WbemLocator:IUnknown:AddRef (This=0x6c2908) returned 0x3 [0324.782] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dea4 | out: ppvObject=0x18dea4*=0x0) returned 0x80004002 [0324.782] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de54 | out: ppvObject=0x18de54*=0x0) returned 0x80004002 [0324.782] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de60 | out: ppvObject=0x18de60*=0x6c2864) returned 0x0 [0324.782] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de68 | out: pCid=0x18de68*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.782] WbemLocator:IUnknown:Release (This=0x6c2864) returned 0x3 [0324.783] CoGetContextToken (in: pToken=0x18dec0 | out: pToken=0x18dec0) returned 0x0 [0324.783] CoGetContextToken (in: pToken=0x18e2c8 | out: pToken=0x18e2c8) returned 0x0 [0324.783] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x6c28ec) returned 0x0 [0324.783] WbemLocator:IRpcOptions:Query (in: This=0x6c28ec, pPrx=0x6c2908, dwProperty=2, pdwValue=0x18e360 | out: pdwValue=0x18e360) returned 0x80004002 [0324.783] WbemLocator:IUnknown:Release (This=0x6c28ec) returned 0x3 [0324.784] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x2 [0324.784] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0324.784] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0324.785] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73c450) returned 0x0 [0324.785] IUnknown:AddRef (This=0x73c450) returned 0x4 [0324.785] IUnknown:Release (This=0x73c450) returned 0x3 [0324.785] IUnknown:Release (This=0x73c450) returned 0x2 [0324.785] WbemLocator:IUnknown:Release (This=0x58c4f88) returned 0x2 [0324.785] SysStringLen (param_1=0x0) returned 0x0 [0324.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872810, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0324.785] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x18, pszText=0x0) returned 0x0 [0324.785] WbemDefPath:IWbemPath:GetText (in: This=0x5872810, lFlags=4, puBuffLength=0x18eb90*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x18eb90*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0324.785] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0324.785] IUnknown:AddRef (This=0x73c450) returned 0x3 [0324.785] IEnumWbemClassObject:Clone (in: This=0x73c450, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73c770) returned 0x0 [0324.787] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73c774) returned 0x0 [0324.788] IClientSecurity:QueryBlanket (in: This=0x73c774, pProxy=0x73c770, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0324.788] IUnknown:Release (This=0x73c774) returned 0x1 [0324.788] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c1808) returned 0x0 [0324.788] IUnknown:QueryInterface (in: This=0x73c770, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73c774) returned 0x0 [0324.788] IClientSecurity:SetBlanket (This=0x73c774, pProxy=0x73c770, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0324.812] IUnknown:Release (This=0x73c774) returned 0x2 [0324.812] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0324.812] CoTaskMemFree (pv=0x6be2b8) [0324.812] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c1808) returned 0x0 [0324.813] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0324.813] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0324.814] IUnknown:QueryInterface (in: This=0x73c770, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0324.815] WbemLocator:IUnknown:AddRef (This=0x6c1808) returned 0x3 [0324.815] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0324.815] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0324.815] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c1764) returned 0x0 [0324.815] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1764, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.815] WbemLocator:IUnknown:Release (This=0x6c1764) returned 0x3 [0324.815] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0324.816] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0324.816] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c17ec) returned 0x0 [0324.816] WbemLocator:IRpcOptions:Query (in: This=0x6c17ec, pPrx=0x6c1808, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0324.816] WbemLocator:IUnknown:Release (This=0x6c17ec) returned 0x3 [0324.816] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x2 [0324.816] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0324.816] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0324.816] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1808, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73c770) returned 0x0 [0324.816] IUnknown:AddRef (This=0x73c770) returned 0x4 [0324.816] IUnknown:Release (This=0x73c770) returned 0x3 [0324.816] IUnknown:Release (This=0x73c770) returned 0x2 [0324.816] IUnknown:Release (This=0x73c450) returned 0x2 [0324.816] SysStringLen (param_1=0x0) returned 0x0 [0324.816] IEnumWbemClassObject:Reset (This=0x73c770) returned 0x0 [0324.817] CoTaskMemAlloc (cb=0x4) returned 0x586b410 [0324.817] IEnumWbemClassObject:Next (in: This=0x73c770, lTimeout=-1, uCount=0x1, apObjects=0x586b410, puReturned=0x23519c8 | out: apObjects=0x586b410*=0x0, puReturned=0x23519c8*=0x0) returned 0x1 [0324.818] CoTaskMemFree (pv=0x586b410) [0324.818] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.818] WbemLocator:IUnknown:Release (This=0x6c1808) returned 0x1 [0324.819] IUnknown:Release (This=0x73c770) returned 0x0 [0324.820] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0324.820] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0324.820] IUnknown:Release (This=0x73c450) returned 0x0 [0324.822] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0324.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0324.822] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0324.822] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.824] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b3c0) returned 0x0 [0324.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b3c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0324.824] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b3c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58730d0) returned 0x0 [0324.824] WbemDefPath:IUnknown:Release (This=0x586b3c0) returned 0x0 [0324.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58730d0) returned 0x0 [0324.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0324.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0324.825] WbemDefPath:IUnknown:AddRef (This=0x58730d0) returned 0x3 [0324.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0324.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0324.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58caa78) returned 0x0 [0324.825] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58caa78, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0324.825] WbemDefPath:IUnknown:Release (This=0x58caa78) returned 0x3 [0324.825] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0324.825] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0324.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0324.825] WbemDefPath:IUnknown:Release (This=0x58730d0) returned 0x2 [0324.826] WbemDefPath:IUnknown:Release (This=0x58730d0) returned 0x1 [0324.826] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0324.826] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0324.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x58730d0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58730d0) returned 0x0 [0324.826] WbemDefPath:IUnknown:AddRef (This=0x58730d0) returned 0x3 [0324.826] WbemDefPath:IUnknown:Release (This=0x58730d0) returned 0x2 [0324.826] WbemDefPath:IWbemPath:SetText (This=0x58730d0, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0324.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0324.826] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x19, pszText=0x0) returned 0x0 [0324.826] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebe0*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebe0*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0324.826] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0324.826] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x19, pszText=0x0) returned 0x0 [0324.827] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebcc*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebcc*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0324.827] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0324.827] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0324.827] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0324.827] IUnknown:Release (This=0x692bc4) returned 0x1 [0324.828] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58cac58) returned 0x0 [0324.828] WbemLocator:IUnknown:QueryInterface (in: This=0x58cac58, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0324.828] WbemLocator:IClassFactory:CreateInstance (in: This=0x58cac58, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b310) returned 0x0 [0324.828] WbemLocator:IUnknown:Release (This=0x58cac58) returned 0x0 [0324.828] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b310) returned 0x0 [0324.828] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0324.828] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0324.829] WbemLocator:IUnknown:AddRef (This=0x586b310) returned 0x3 [0324.829] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0324.829] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0324.829] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0324.829] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0324.829] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0324.829] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0324.829] WbemLocator:IUnknown:Release (This=0x586b310) returned 0x2 [0324.829] WbemLocator:IUnknown:Release (This=0x586b310) returned 0x1 [0324.829] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0324.829] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0324.829] WbemLocator:IUnknown:QueryInterface (in: This=0x586b310, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b310) returned 0x0 [0324.830] WbemLocator:IUnknown:AddRef (This=0x586b310) returned 0x3 [0324.830] WbemLocator:IUnknown:Release (This=0x586b310) returned 0x2 [0324.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0324.830] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x19, pszText=0x0) returned 0x0 [0324.830] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=8, puBuffLength=0x18eb38*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb38*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0324.830] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b470) returned 0x0 [0324.830] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b470, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x58c4c68) returned 0x0 [0325.053] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c68, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c16e4) returned 0x0 [0325.053] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c16e4, pProxy=0x58c4c68, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0325.054] WbemLocator:IUnknown:Release (This=0x6c16e4) returned 0x1 [0325.054] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c68, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c1708) returned 0x0 [0325.054] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c68, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c16e4) returned 0x0 [0325.054] WbemLocator:IClientSecurity:SetBlanket (This=0x6c16e4, pProxy=0x58c4c68, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.054] WbemLocator:IUnknown:Release (This=0x6c16e4) returned 0x2 [0325.054] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x1 [0325.054] CoTaskMemFree (pv=0x586eda0) [0325.055] WbemLocator:IUnknown:Release (This=0x586b470) returned 0x0 [0325.055] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c1708) returned 0x0 [0325.055] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0325.077] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0325.084] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0325.092] WbemLocator:IUnknown:AddRef (This=0x6c1708) returned 0x3 [0325.092] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0325.092] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0325.092] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c1664) returned 0x0 [0325.092] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1664, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.093] WbemLocator:IUnknown:Release (This=0x6c1664) returned 0x3 [0325.093] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0325.093] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0325.093] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c16ec) returned 0x0 [0325.093] WbemLocator:IRpcOptions:Query (in: This=0x6c16ec, pPrx=0x6c1708, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0325.093] WbemLocator:IUnknown:Release (This=0x6c16ec) returned 0x3 [0325.093] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x2 [0325.093] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0325.093] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0325.093] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x58c4c68) returned 0x0 [0325.093] WbemLocator:IUnknown:AddRef (This=0x58c4c68) returned 0x4 [0325.093] WbemLocator:IUnknown:Release (This=0x58c4c68) returned 0x3 [0325.094] WbemLocator:IUnknown:Release (This=0x58c4c68) returned 0x2 [0325.094] SysStringLen (param_1=0x0) returned 0x0 [0325.094] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0325.094] WbemLocator:IUnknown:AddRef (This=0x6c1708) returned 0x3 [0325.094] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c1708) returned 0x0 [0325.094] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x3 [0325.094] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x2 [0325.094] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0325.094] WbemLocator:IUnknown:AddRef (This=0x58c4c68) returned 0x3 [0325.094] IWbemServices:ExecQuery (in: This=0x58c4c68, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73c068) returned 0x0 [0325.146] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x73c06c) returned 0x0 [0325.146] IClientSecurity:QueryBlanket (in: This=0x73c06c, pProxy=0x73c068, pAuthnSvc=0x18e9f4, pAuthzSvc=0x18e9f0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec, pImpLevel=0x18e9dc, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4 | out: pAuthnSvc=0x18e9f4*=0xa, pAuthzSvc=0x18e9f0*=0x0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec*=0x6, pImpLevel=0x18e9dc*=0x2, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4*=0x1) returned 0x0 [0325.146] IUnknown:Release (This=0x73c06c) returned 0x1 [0325.146] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x6c1c08) returned 0x0 [0325.146] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x73c06c) returned 0x0 [0325.147] IClientSecurity:SetBlanket (This=0x73c06c, pProxy=0x73c068, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.149] IUnknown:Release (This=0x73c06c) returned 0x2 [0325.149] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0325.149] CoTaskMemFree (pv=0x586e9e0) [0325.149] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x6c1c08) returned 0x0 [0325.150] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e54c | out: ppvObject=0x18e54c*=0x0) returned 0x80004002 [0325.151] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x0) returned 0x80004002 [0325.152] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e144 | out: ppvObject=0x18e144*=0x0) returned 0x80004002 [0325.153] WbemLocator:IUnknown:AddRef (This=0x6c1c08) returned 0x3 [0325.153] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dea4 | out: ppvObject=0x18dea4*=0x0) returned 0x80004002 [0325.153] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de54 | out: ppvObject=0x18de54*=0x0) returned 0x80004002 [0325.153] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de60 | out: ppvObject=0x18de60*=0x6c1b64) returned 0x0 [0325.153] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1b64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de68 | out: pCid=0x18de68*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.153] WbemLocator:IUnknown:Release (This=0x6c1b64) returned 0x3 [0325.153] CoGetContextToken (in: pToken=0x18dec0 | out: pToken=0x18dec0) returned 0x0 [0325.154] CoGetContextToken (in: pToken=0x18e2c8 | out: pToken=0x18e2c8) returned 0x0 [0325.154] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x6c1bec) returned 0x0 [0325.154] WbemLocator:IRpcOptions:Query (in: This=0x6c1bec, pPrx=0x6c1c08, dwProperty=2, pdwValue=0x18e360 | out: pdwValue=0x18e360) returned 0x80004002 [0325.154] WbemLocator:IUnknown:Release (This=0x6c1bec) returned 0x3 [0325.154] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x2 [0325.154] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0325.154] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0325.154] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73c068) returned 0x0 [0325.154] IUnknown:AddRef (This=0x73c068) returned 0x4 [0325.154] IUnknown:Release (This=0x73c068) returned 0x3 [0325.154] IUnknown:Release (This=0x73c068) returned 0x2 [0325.155] WbemLocator:IUnknown:Release (This=0x58c4c68) returned 0x2 [0325.155] SysStringLen (param_1=0x0) returned 0x0 [0325.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0325.155] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x19, pszText=0x0) returned 0x0 [0325.155] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.155] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0325.155] IUnknown:AddRef (This=0x73c068) returned 0x3 [0325.155] IEnumWbemClassObject:Clone (in: This=0x73c068, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73bc80) returned 0x0 [0325.158] IUnknown:QueryInterface (in: This=0x73bc80, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73bc84) returned 0x0 [0325.158] IClientSecurity:QueryBlanket (in: This=0x73bc84, pProxy=0x73bc80, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0325.158] IUnknown:Release (This=0x73bc84) returned 0x1 [0325.158] IUnknown:QueryInterface (in: This=0x73bc80, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c2908) returned 0x0 [0325.158] IUnknown:QueryInterface (in: This=0x73bc80, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73bc84) returned 0x0 [0325.158] IClientSecurity:SetBlanket (This=0x73bc84, pProxy=0x73bc80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.224] IUnknown:Release (This=0x73bc84) returned 0x2 [0325.224] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0325.224] CoTaskMemFree (pv=0x6be2e8) [0325.225] IUnknown:QueryInterface (in: This=0x73bc80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c2908) returned 0x0 [0325.225] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0325.226] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0325.227] IUnknown:QueryInterface (in: This=0x73bc80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0325.228] WbemLocator:IUnknown:AddRef (This=0x6c2908) returned 0x3 [0325.228] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0325.229] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0325.229] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c2864) returned 0x0 [0325.229] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.229] WbemLocator:IUnknown:Release (This=0x6c2864) returned 0x3 [0325.229] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0325.229] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0325.229] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c28ec) returned 0x0 [0325.230] WbemLocator:IRpcOptions:Query (in: This=0x6c28ec, pPrx=0x6c2908, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0325.230] WbemLocator:IUnknown:Release (This=0x6c28ec) returned 0x3 [0325.230] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x2 [0325.230] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0325.230] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0325.230] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73bc80) returned 0x0 [0325.230] IUnknown:AddRef (This=0x73bc80) returned 0x4 [0325.230] IUnknown:Release (This=0x73bc80) returned 0x3 [0325.230] IUnknown:Release (This=0x73bc80) returned 0x2 [0325.230] IUnknown:Release (This=0x73c068) returned 0x2 [0325.230] SysStringLen (param_1=0x0) returned 0x0 [0325.230] IEnumWbemClassObject:Reset (This=0x73bc80) returned 0x0 [0325.232] CoTaskMemAlloc (cb=0x4) returned 0x586b3c0 [0325.232] IEnumWbemClassObject:Next (in: This=0x73bc80, lTimeout=-1, uCount=0x1, apObjects=0x586b3c0, puReturned=0x2352ee0 | out: apObjects=0x586b3c0*=0x6cac68, puReturned=0x2352ee0*=0x1) returned 0x0 [0325.235] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1f8 | out: ppvObject=0x18e1f8*=0x6cac68) returned 0x0 [0325.235] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1b4 | out: ppvObject=0x18e1b4*=0x0) returned 0x80004002 [0325.235] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dfd4 | out: ppvObject=0x18dfd4*=0x0) returned 0x80004002 [0325.235] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddac | out: ppvObject=0x18ddac*=0x0) returned 0x80004002 [0325.236] IUnknown:AddRef (This=0x6cac68) returned 0x3 [0325.236] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0325.236] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dabc | out: ppvObject=0x18dabc*=0x0) returned 0x80004002 [0325.236] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dac8 | out: ppvObject=0x18dac8*=0x6cac6c) returned 0x0 [0325.236] IMarshal:GetUnmarshalClass (in: This=0x6cac6c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dad0 | out: pCid=0x18dad0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0325.236] IUnknown:Release (This=0x6cac6c) returned 0x3 [0325.236] CoGetContextToken (in: pToken=0x18db28 | out: pToken=0x18db28) returned 0x0 [0325.236] CoGetContextToken (in: pToken=0x18df30 | out: pToken=0x18df30) returned 0x0 [0325.236] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfbc | out: ppvObject=0x18dfbc*=0x0) returned 0x80004002 [0325.237] IUnknown:Release (This=0x6cac68) returned 0x2 [0325.237] CoGetContextToken (in: pToken=0x18e508 | out: pToken=0x18e508) returned 0x0 [0325.237] CoGetContextToken (in: pToken=0x18e468 | out: pToken=0x18e468) returned 0x0 [0325.237] IUnknown:QueryInterface (in: This=0x6cac68, riid=0x18e538*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e534 | out: ppvObject=0x18e534*=0x6cac68) returned 0x0 [0325.237] IUnknown:AddRef (This=0x6cac68) returned 0x4 [0325.238] IUnknown:Release (This=0x6cac68) returned 0x3 [0325.238] IUnknown:Release (This=0x6cac68) returned 0x2 [0325.238] CoTaskMemFree (pv=0x586b3c0) [0325.238] CoGetContextToken (in: pToken=0x18e880 | out: pToken=0x18e880) returned 0x0 [0325.238] IUnknown:AddRef (This=0x6cac68) returned 0x3 [0325.238] IWbemClassObject:Get (in: This=0x6cac68, wszName="__GENUS", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec10*=0, plFlavor=0x18ec0c*=0 | out: pVal=0x18eb90*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec10*=3, plFlavor=0x18ec0c*=64) returned 0x0 [0325.238] IWbemClassObject:Get (in: This=0x6cac68, wszName="__PATH", lFlags=0, pVal=0x18eb74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ebf8*=0, plFlavor=0x18ebf4*=0 | out: pVal=0x18eb74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x18ebf8*=8, plFlavor=0x18ebf4*=64) returned 0x0 [0325.239] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0325.240] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0325.240] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eba0 | out: ppv=0x18eba0*=0x692bc4) returned 0x0 [0325.240] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb98 | out: pAptType=0x18eb98*=1) returned 0x0 [0325.240] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb9c | out: ppvObject=0x18eb9c*=0x0) returned 0x80004002 [0325.240] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.242] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e508 | out: ppv=0x18e508*=0x586b360) returned 0x0 [0325.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e724 | out: ppvObject=0x18e724*=0x0) returned 0x80004002 [0325.242] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e730 | out: ppvObject=0x18e730*=0x5872960) returned 0x0 [0325.242] WbemDefPath:IUnknown:Release (This=0x586b360) returned 0x0 [0325.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x5872960) returned 0x0 [0325.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e310 | out: ppvObject=0x18e310*=0x0) returned 0x80004002 [0325.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df04 | out: ppvObject=0x18df04*=0x0) returned 0x80004002 [0325.243] WbemDefPath:IUnknown:AddRef (This=0x5872960) returned 0x3 [0325.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0325.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc14 | out: ppvObject=0x18dc14*=0x0) returned 0x80004002 [0325.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc20 | out: ppvObject=0x18dc20*=0x58cafb8) returned 0x0 [0325.243] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cafb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc28 | out: pCid=0x18dc28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.243] WbemDefPath:IUnknown:Release (This=0x58cafb8) returned 0x3 [0325.243] CoGetContextToken (in: pToken=0x18dc80 | out: pToken=0x18dc80) returned 0x0 [0325.243] CoGetContextToken (in: pToken=0x18e088 | out: pToken=0x18e088) returned 0x0 [0325.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e114 | out: ppvObject=0x18e114*=0x0) returned 0x80004002 [0325.244] WbemDefPath:IUnknown:Release (This=0x5872960) returned 0x2 [0325.244] WbemDefPath:IUnknown:Release (This=0x5872960) returned 0x1 [0325.244] CoGetContextToken (in: pToken=0x18ea18 | out: pToken=0x18ea18) returned 0x0 [0325.244] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0325.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872960, riid=0x18ea48*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea44 | out: ppvObject=0x18ea44*=0x5872960) returned 0x0 [0325.244] WbemDefPath:IUnknown:AddRef (This=0x5872960) returned 0x3 [0325.244] WbemDefPath:IUnknown:Release (This=0x5872960) returned 0x2 [0325.244] WbemDefPath:IWbemPath:SetText (This=0x5872960, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0325.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18ebcc | out: puCount=0x18ebcc*=0x2) returned 0x0 [0325.244] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebc8*=0x0, pszText=0x0 | out: puBuffLength=0x18ebc8*=0x19, pszText=0x0) returned 0x0 [0325.244] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18ebc8*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebc8*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18eb98 | out: puCount=0x18eb98*=0x2) returned 0x0 [0325.244] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb94*=0x0, pszText=0x0 | out: puBuffLength=0x18eb94*=0x19, pszText=0x0) returned 0x0 [0325.245] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb94*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb94*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.245] IWbemClassObject:Get (in: This=0x6cac68, wszName="displayName", lFlags=0, pVal=0x18eb94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23537c0*=0, plFlavor=0x23537c4*=0 | out: pVal=0x18eb94*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23537c0*=8, plFlavor=0x23537c4*=0) returned 0x0 [0325.245] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.245] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.245] IWbemClassObject:Get (in: This=0x6cac68, wszName="displayName", lFlags=0, pVal=0x18eb9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23537c0*=8, plFlavor=0x23537c4*=0 | out: pVal=0x18eb9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23537c0*=8, plFlavor=0x23537c4*=0) returned 0x0 [0325.245] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.245] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.246] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x58730d0, puCount=0x18eb98 | out: puCount=0x18eb98*=0x2) returned 0x0 [0325.246] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb94*=0x0, pszText=0x0 | out: puBuffLength=0x18eb94*=0x19, pszText=0x0) returned 0x0 [0325.246] WbemDefPath:IWbemPath:GetText (in: This=0x58730d0, lFlags=4, puBuffLength=0x18eb94*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb94*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.246] IWbemClassObject:Get (in: This=0x6cac68, wszName="displayName", lFlags=0, pVal=0x18eb94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23538d0*=0, plFlavor=0x23538d4*=0 | out: pVal=0x18eb94*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23538d0*=8, plFlavor=0x23538d4*=0) returned 0x0 [0325.246] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.246] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.246] IWbemClassObject:Get (in: This=0x6cac68, wszName="displayName", lFlags=0, pVal=0x18eb9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23538d0*=8, plFlavor=0x23538d4*=0 | out: pVal=0x18eb9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23538d0*=8, plFlavor=0x23538d4*=0) returned 0x0 [0325.246] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.246] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.246] CoTaskMemAlloc (cb=0x4) returned 0x586b360 [0325.246] IEnumWbemClassObject:Next (in: This=0x73bc80, lTimeout=-1, uCount=0x1, apObjects=0x586b360, puReturned=0x2352ee0 | out: apObjects=0x586b360*=0x0, puReturned=0x2352ee0*=0x0) returned 0x1 [0325.249] CoTaskMemFree (pv=0x586b360) [0325.249] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.249] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0325.249] IUnknown:Release (This=0x73bc80) returned 0x0 [0325.274] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.274] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0325.274] IUnknown:Release (This=0x73c068) returned 0x0 [0325.277] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0325.277] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0325.278] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0325.278] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.279] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0325.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0325.279] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872d50) returned 0x0 [0325.280] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872d50) returned 0x0 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0325.280] WbemDefPath:IUnknown:AddRef (This=0x5872d50) returned 0x3 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0325.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58caa00) returned 0x0 [0325.280] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58caa00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.281] WbemDefPath:IUnknown:Release (This=0x58caa00) returned 0x3 [0325.281] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0325.281] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0325.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0325.281] WbemDefPath:IUnknown:Release (This=0x5872d50) returned 0x2 [0325.281] WbemDefPath:IUnknown:Release (This=0x5872d50) returned 0x1 [0325.281] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0325.281] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0325.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872d50, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872d50) returned 0x0 [0325.281] WbemDefPath:IUnknown:AddRef (This=0x5872d50) returned 0x3 [0325.281] WbemDefPath:IUnknown:Release (This=0x5872d50) returned 0x2 [0325.282] WbemDefPath:IWbemPath:SetText (This=0x5872d50, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x19, pszText=0x0) returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebe0*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebe0*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x19, pszText=0x0) returned 0x0 [0325.282] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebcc*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebcc*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.282] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0325.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0325.282] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0325.283] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.284] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58caf28) returned 0x0 [0325.284] WbemLocator:IUnknown:QueryInterface (in: This=0x58caf28, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0325.284] WbemLocator:IClassFactory:CreateInstance (in: This=0x58caf28, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b2f0) returned 0x0 [0325.284] WbemLocator:IUnknown:Release (This=0x58caf28) returned 0x0 [0325.284] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b2f0) returned 0x0 [0325.284] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0325.284] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0325.285] WbemLocator:IUnknown:AddRef (This=0x586b2f0) returned 0x3 [0325.285] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0325.285] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0325.285] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0325.285] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0325.285] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0325.285] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0325.285] WbemLocator:IUnknown:Release (This=0x586b2f0) returned 0x2 [0325.285] WbemLocator:IUnknown:Release (This=0x586b2f0) returned 0x1 [0325.285] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0325.285] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0325.285] WbemLocator:IUnknown:QueryInterface (in: This=0x586b2f0, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b2f0) returned 0x0 [0325.285] WbemLocator:IUnknown:AddRef (This=0x586b2f0) returned 0x3 [0325.285] WbemLocator:IUnknown:Release (This=0x586b2f0) returned 0x2 [0325.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0325.286] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x19, pszText=0x0) returned 0x0 [0325.286] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=8, puBuffLength=0x18eb38*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb38*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.286] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b360) returned 0x0 [0325.286] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b360, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x58c4c18) returned 0x0 [0325.364] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c18, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c1de4) returned 0x0 [0325.364] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c1de4, pProxy=0x58c4c18, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0325.364] WbemLocator:IUnknown:Release (This=0x6c1de4) returned 0x1 [0325.365] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c18, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c1e08) returned 0x0 [0325.365] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c18, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c1de4) returned 0x0 [0325.365] WbemLocator:IClientSecurity:SetBlanket (This=0x6c1de4, pProxy=0x58c4c18, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.365] WbemLocator:IUnknown:Release (This=0x6c1de4) returned 0x2 [0325.365] WbemLocator:IUnknown:Release (This=0x6c1e08) returned 0x1 [0325.365] CoTaskMemFree (pv=0x586e9e0) [0325.366] WbemLocator:IUnknown:Release (This=0x586b360) returned 0x0 [0325.366] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c1e08) returned 0x0 [0325.366] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0325.367] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0325.368] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4c18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0325.369] WbemLocator:IUnknown:AddRef (This=0x6c1e08) returned 0x3 [0325.369] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0325.369] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0325.370] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c1d64) returned 0x0 [0325.370] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1d64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.370] WbemLocator:IUnknown:Release (This=0x6c1d64) returned 0x3 [0325.370] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0325.370] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0325.370] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c1dec) returned 0x0 [0325.370] WbemLocator:IRpcOptions:Query (in: This=0x6c1dec, pPrx=0x6c1e08, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0325.370] WbemLocator:IUnknown:Release (This=0x6c1dec) returned 0x3 [0325.370] WbemLocator:IUnknown:Release (This=0x6c1e08) returned 0x2 [0325.371] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0325.371] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0325.371] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x58c4c18) returned 0x0 [0325.371] WbemLocator:IUnknown:AddRef (This=0x58c4c18) returned 0x4 [0325.371] WbemLocator:IUnknown:Release (This=0x58c4c18) returned 0x3 [0325.371] WbemLocator:IUnknown:Release (This=0x58c4c18) returned 0x2 [0325.371] SysStringLen (param_1=0x0) returned 0x0 [0325.371] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0325.371] WbemLocator:IUnknown:AddRef (This=0x6c1e08) returned 0x3 [0325.371] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1e08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c1e08) returned 0x0 [0325.372] WbemLocator:IUnknown:Release (This=0x6c1e08) returned 0x3 [0325.372] WbemLocator:IUnknown:Release (This=0x6c1e08) returned 0x2 [0325.372] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0325.372] WbemLocator:IUnknown:AddRef (This=0x58c4c18) returned 0x3 [0325.372] IWbemServices:ExecQuery (in: This=0x58c4c18, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73ca90) returned 0x0 [0325.393] IUnknown:QueryInterface (in: This=0x73ca90, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a0 | out: ppvObject=0x18e9a0*=0x73ca94) returned 0x0 [0325.393] IClientSecurity:QueryBlanket (in: This=0x73ca94, pProxy=0x73ca90, pAuthnSvc=0x18e9f0, pAuthzSvc=0x18e9ec, pServerPrincName=0x18e9e4, pAuthnLevel=0x18e9e8, pImpLevel=0x18e9d8, pAuthInfo=0x18e9dc, pCapabilites=0x18e9e0 | out: pAuthnSvc=0x18e9f0*=0xa, pAuthzSvc=0x18e9ec*=0x0, pServerPrincName=0x18e9e4, pAuthnLevel=0x18e9e8*=0x6, pImpLevel=0x18e9d8*=0x2, pAuthInfo=0x18e9dc, pCapabilites=0x18e9e0*=0x1) returned 0x0 [0325.393] IUnknown:Release (This=0x73ca94) returned 0x1 [0325.393] IUnknown:QueryInterface (in: This=0x73ca90, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0x6c3208) returned 0x0 [0325.394] IUnknown:QueryInterface (in: This=0x73ca90, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e980 | out: ppvObject=0x18e980*=0x73ca94) returned 0x0 [0325.394] IClientSecurity:SetBlanket (This=0x73ca94, pProxy=0x73ca90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.407] IUnknown:Release (This=0x73ca94) returned 0x2 [0325.407] WbemLocator:IUnknown:Release (This=0x6c3208) returned 0x1 [0325.407] CoTaskMemFree (pv=0x6be2e8) [0325.407] IUnknown:QueryInterface (in: This=0x73ca90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e58c | out: ppvObject=0x18e58c*=0x6c3208) returned 0x0 [0325.408] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e548 | out: ppvObject=0x18e548*=0x0) returned 0x80004002 [0325.504] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e364 | out: ppvObject=0x18e364*=0x0) returned 0x80004002 [0325.505] IUnknown:QueryInterface (in: This=0x73ca90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e13c | out: ppvObject=0x18e13c*=0x0) returned 0x80004002 [0325.506] WbemLocator:IUnknown:AddRef (This=0x6c3208) returned 0x3 [0325.506] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de9c | out: ppvObject=0x18de9c*=0x0) returned 0x80004002 [0325.506] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de4c | out: ppvObject=0x18de4c*=0x0) returned 0x80004002 [0325.506] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de58 | out: ppvObject=0x18de58*=0x6c3164) returned 0x0 [0325.507] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c3164, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de60 | out: pCid=0x18de60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.507] WbemLocator:IUnknown:Release (This=0x6c3164) returned 0x3 [0325.507] CoGetContextToken (in: pToken=0x18deb8 | out: pToken=0x18deb8) returned 0x0 [0325.507] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0325.507] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0x6c31ec) returned 0x0 [0325.507] WbemLocator:IRpcOptions:Query (in: This=0x6c31ec, pPrx=0x6c3208, dwProperty=2, pdwValue=0x18e358 | out: pdwValue=0x18e358) returned 0x80004002 [0325.508] WbemLocator:IUnknown:Release (This=0x6c31ec) returned 0x3 [0325.508] WbemLocator:IUnknown:Release (This=0x6c3208) returned 0x2 [0325.508] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0325.508] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0325.508] WbemLocator:IUnknown:QueryInterface (in: This=0x6c3208, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73ca90) returned 0x0 [0325.508] IUnknown:AddRef (This=0x73ca90) returned 0x4 [0325.508] IUnknown:Release (This=0x73ca90) returned 0x3 [0325.508] IUnknown:Release (This=0x73ca90) returned 0x2 [0325.508] WbemLocator:IUnknown:Release (This=0x58c4c18) returned 0x2 [0325.508] SysStringLen (param_1=0x0) returned 0x0 [0325.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0325.508] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x19, pszText=0x0) returned 0x0 [0325.508] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18eb90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.509] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0325.509] IUnknown:AddRef (This=0x73ca90) returned 0x3 [0325.509] IEnumWbemClassObject:Clone (in: This=0x73ca90, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73bd48) returned 0x0 [0325.511] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73bd4c) returned 0x0 [0325.511] IClientSecurity:QueryBlanket (in: This=0x73bd4c, pProxy=0x73bd48, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0325.511] IUnknown:Release (This=0x73bd4c) returned 0x1 [0325.511] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c1f08) returned 0x0 [0325.511] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73bd4c) returned 0x0 [0325.511] IClientSecurity:SetBlanket (This=0x73bd4c, pProxy=0x73bd48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.514] IUnknown:Release (This=0x73bd4c) returned 0x2 [0325.514] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x1 [0325.514] CoTaskMemFree (pv=0x6e9e90) [0325.514] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c1f08) returned 0x0 [0325.515] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0325.516] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0325.526] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0325.554] WbemLocator:IUnknown:AddRef (This=0x6c1f08) returned 0x3 [0325.554] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0325.554] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0325.555] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c1e64) returned 0x0 [0325.555] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1e64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.555] WbemLocator:IUnknown:Release (This=0x6c1e64) returned 0x3 [0325.555] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0325.555] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0325.555] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c1eec) returned 0x0 [0325.555] WbemLocator:IRpcOptions:Query (in: This=0x6c1eec, pPrx=0x6c1f08, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0325.555] WbemLocator:IUnknown:Release (This=0x6c1eec) returned 0x3 [0325.556] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x2 [0325.556] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0325.556] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0325.556] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73bd48) returned 0x0 [0325.556] IUnknown:AddRef (This=0x73bd48) returned 0x4 [0325.556] IUnknown:Release (This=0x73bd48) returned 0x3 [0325.556] IUnknown:Release (This=0x73bd48) returned 0x2 [0325.556] IUnknown:Release (This=0x73ca90) returned 0x2 [0325.556] SysStringLen (param_1=0x0) returned 0x0 [0325.556] IEnumWbemClassObject:Reset (This=0x73bd48) returned 0x0 [0325.557] CoTaskMemAlloc (cb=0x4) returned 0x586b3c0 [0325.557] IEnumWbemClassObject:Next (in: This=0x73bd48, lTimeout=-1, uCount=0x1, apObjects=0x586b3c0, puReturned=0x2354a00 | out: apObjects=0x586b3c0*=0x6cbdf0, puReturned=0x2354a00*=0x1) returned 0x0 [0325.559] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e1f8 | out: ppvObject=0x18e1f8*=0x6cbdf0) returned 0x0 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1b4 | out: ppvObject=0x18e1b4*=0x0) returned 0x80004002 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dfd4 | out: ppvObject=0x18dfd4*=0x0) returned 0x80004002 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddac | out: ppvObject=0x18ddac*=0x0) returned 0x80004002 [0325.560] IUnknown:AddRef (This=0x6cbdf0) returned 0x3 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db0c | out: ppvObject=0x18db0c*=0x0) returned 0x80004002 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dabc | out: ppvObject=0x18dabc*=0x0) returned 0x80004002 [0325.560] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dac8 | out: ppvObject=0x18dac8*=0x6cbdf4) returned 0x0 [0325.561] IMarshal:GetUnmarshalClass (in: This=0x6cbdf4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dad0 | out: pCid=0x18dad0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0325.561] IUnknown:Release (This=0x6cbdf4) returned 0x3 [0325.561] CoGetContextToken (in: pToken=0x18db28 | out: pToken=0x18db28) returned 0x0 [0325.561] CoGetContextToken (in: pToken=0x18df30 | out: pToken=0x18df30) returned 0x0 [0325.561] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfbc | out: ppvObject=0x18dfbc*=0x0) returned 0x80004002 [0325.561] IUnknown:Release (This=0x6cbdf0) returned 0x2 [0325.561] CoGetContextToken (in: pToken=0x18e508 | out: pToken=0x18e508) returned 0x0 [0325.561] CoGetContextToken (in: pToken=0x18e468 | out: pToken=0x18e468) returned 0x0 [0325.561] IUnknown:QueryInterface (in: This=0x6cbdf0, riid=0x18e538*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e534 | out: ppvObject=0x18e534*=0x6cbdf0) returned 0x0 [0325.561] IUnknown:AddRef (This=0x6cbdf0) returned 0x4 [0325.561] IUnknown:Release (This=0x6cbdf0) returned 0x3 [0325.562] IUnknown:Release (This=0x6cbdf0) returned 0x2 [0325.562] CoTaskMemFree (pv=0x586b3c0) [0325.562] CoGetContextToken (in: pToken=0x18e880 | out: pToken=0x18e880) returned 0x0 [0325.562] IUnknown:AddRef (This=0x6cbdf0) returned 0x3 [0325.562] IWbemClassObject:Get (in: This=0x6cbdf0, wszName="__GENUS", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec10*=0, plFlavor=0x18ec0c*=0 | out: pVal=0x18eb90*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec10*=3, plFlavor=0x18ec0c*=64) returned 0x0 [0325.562] IWbemClassObject:Get (in: This=0x6cbdf0, wszName="__PATH", lFlags=0, pVal=0x18eb74*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ebf8*=0, plFlavor=0x18ebf4*=0 | out: pVal=0x18eb74*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x18ebf8*=8, plFlavor=0x18ebf4*=64) returned 0x0 [0325.562] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0325.562] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0325.563] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eba0 | out: ppv=0x18eba0*=0x692bc4) returned 0x0 [0325.563] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb98 | out: pAptType=0x18eb98*=1) returned 0x0 [0325.563] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb9c | out: ppvObject=0x18eb9c*=0x0) returned 0x80004002 [0325.563] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.564] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e508 | out: ppv=0x18e508*=0x586b2e0) returned 0x0 [0325.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e724 | out: ppvObject=0x18e724*=0x0) returned 0x80004002 [0325.564] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e730 | out: ppvObject=0x18e730*=0x5872dc0) returned 0x0 [0325.565] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0325.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x5872dc0) returned 0x0 [0325.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e310 | out: ppvObject=0x18e310*=0x0) returned 0x80004002 [0325.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df04 | out: ppvObject=0x18df04*=0x0) returned 0x80004002 [0325.570] WbemDefPath:IUnknown:AddRef (This=0x5872dc0) returned 0x3 [0325.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc64 | out: ppvObject=0x18dc64*=0x0) returned 0x80004002 [0325.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc14 | out: ppvObject=0x18dc14*=0x0) returned 0x80004002 [0325.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc20 | out: ppvObject=0x18dc20*=0x58caf58) returned 0x0 [0325.570] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58caf58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc28 | out: pCid=0x18dc28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.570] WbemDefPath:IUnknown:Release (This=0x58caf58) returned 0x3 [0325.570] CoGetContextToken (in: pToken=0x18dc80 | out: pToken=0x18dc80) returned 0x0 [0325.571] CoGetContextToken (in: pToken=0x18e088 | out: pToken=0x18e088) returned 0x0 [0325.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e114 | out: ppvObject=0x18e114*=0x0) returned 0x80004002 [0325.571] WbemDefPath:IUnknown:Release (This=0x5872dc0) returned 0x2 [0325.571] WbemDefPath:IUnknown:Release (This=0x5872dc0) returned 0x1 [0325.571] CoGetContextToken (in: pToken=0x18ea18 | out: pToken=0x18ea18) returned 0x0 [0325.571] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0325.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872dc0, riid=0x18ea48*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea44 | out: ppvObject=0x18ea44*=0x5872dc0) returned 0x0 [0325.571] WbemDefPath:IUnknown:AddRef (This=0x5872dc0) returned 0x3 [0325.571] WbemDefPath:IUnknown:Release (This=0x5872dc0) returned 0x2 [0325.571] WbemDefPath:IWbemPath:SetText (This=0x5872dc0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18ebcc | out: puCount=0x18ebcc*=0x2) returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebc8*=0x0, pszText=0x0 | out: puBuffLength=0x18ebc8*=0x19, pszText=0x0) returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18ebc8*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebc8*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872d50, puCount=0x18eb98 | out: puCount=0x18eb98*=0x2) returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18eb94*=0x0, pszText=0x0 | out: puBuffLength=0x18eb94*=0x19, pszText=0x0) returned 0x0 [0325.572] WbemDefPath:IWbemPath:GetText (in: This=0x5872d50, lFlags=4, puBuffLength=0x18eb94*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb94*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.572] IWbemClassObject:Get (in: This=0x6cbdf0, wszName="displayName", lFlags=0, pVal=0x18eb94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23552e4*=0, plFlavor=0x23552e8*=0 | out: pVal=0x18eb94*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23552e4*=8, plFlavor=0x23552e8*=0) returned 0x0 [0325.572] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.572] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.573] IWbemClassObject:Get (in: This=0x6cbdf0, wszName="displayName", lFlags=0, pVal=0x18eb9c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23552e4*=8, plFlavor=0x23552e8*=0 | out: pVal=0x18eb9c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23552e4*=8, plFlavor=0x23552e8*=0) returned 0x0 [0325.573] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.573] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0325.573] CoTaskMemAlloc (cb=0x4) returned 0x586b2c0 [0325.573] IEnumWbemClassObject:Next (in: This=0x73bd48, lTimeout=-1, uCount=0x1, apObjects=0x586b2c0, puReturned=0x2354a00 | out: apObjects=0x586b2c0*=0x0, puReturned=0x2354a00*=0x0) returned 0x1 [0325.575] CoTaskMemFree (pv=0x586b2c0) [0325.575] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.575] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x1 [0325.575] IUnknown:Release (This=0x73bd48) returned 0x0 [0325.577] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.577] WbemLocator:IUnknown:Release (This=0x6c3208) returned 0x1 [0325.577] IUnknown:Release (This=0x73ca90) returned 0x0 [0325.580] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0325.580] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0325.580] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0325.581] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.583] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b440) returned 0x0 [0325.583] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b440, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0325.583] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b440, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872e30) returned 0x0 [0325.584] WbemDefPath:IUnknown:Release (This=0x586b440) returned 0x0 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872e30) returned 0x0 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0325.584] WbemDefPath:IUnknown:AddRef (This=0x5872e30) returned 0x3 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0325.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58caeb0) returned 0x0 [0325.585] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58caeb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.585] WbemDefPath:IUnknown:Release (This=0x58caeb0) returned 0x3 [0325.585] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0325.585] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0325.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0325.585] WbemDefPath:IUnknown:Release (This=0x5872e30) returned 0x2 [0325.585] WbemDefPath:IUnknown:Release (This=0x5872e30) returned 0x1 [0325.585] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0325.585] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0325.586] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872e30, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872e30) returned 0x0 [0325.586] WbemDefPath:IUnknown:AddRef (This=0x5872e30) returned 0x3 [0325.586] WbemDefPath:IUnknown:Release (This=0x5872e30) returned 0x2 [0325.586] WbemDefPath:IWbemPath:SetText (This=0x5872e30, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872e30, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0x19, pszText=0x0) returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18ebe0*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebe0*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872e30, puCount=0x18ebd0 | out: puCount=0x18ebd0*=0x2) returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18ebcc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebcc*=0x19, pszText=0x0) returned 0x0 [0325.586] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18ebcc*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18ebcc*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.586] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb60 | out: ppv=0x18eb60*=0x692bc4) returned 0x0 [0325.587] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb58 | out: pAptType=0x18eb58*=1) returned 0x0 [0325.587] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb5c | out: ppvObject=0x18eb5c*=0x0) returned 0x80004002 [0325.587] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.588] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e770 | out: ppv=0x18e770*=0x58cb0d8) returned 0x0 [0325.588] WbemLocator:IUnknown:QueryInterface (in: This=0x58cb0d8, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x0) returned 0x80004002 [0325.588] WbemLocator:IClassFactory:CreateInstance (in: This=0x58cb0d8, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x586b370) returned 0x0 [0325.588] WbemLocator:IUnknown:Release (This=0x58cb0d8) returned 0x0 [0325.588] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5bc | out: ppvObject=0x18e5bc*=0x586b370) returned 0x0 [0325.589] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e578 | out: ppvObject=0x18e578*=0x0) returned 0x80004002 [0325.589] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e16c | out: ppvObject=0x18e16c*=0x0) returned 0x80004002 [0325.589] WbemLocator:IUnknown:AddRef (This=0x586b370) returned 0x3 [0325.589] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18decc | out: ppvObject=0x18decc*=0x0) returned 0x80004002 [0325.589] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de7c | out: ppvObject=0x18de7c*=0x0) returned 0x80004002 [0325.589] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de88 | out: ppvObject=0x18de88*=0x0) returned 0x80004002 [0325.589] CoGetContextToken (in: pToken=0x18dee8 | out: pToken=0x18dee8) returned 0x0 [0325.590] CoGetContextToken (in: pToken=0x18e2f0 | out: pToken=0x18e2f0) returned 0x0 [0325.590] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0325.590] WbemLocator:IUnknown:Release (This=0x586b370) returned 0x2 [0325.590] WbemLocator:IUnknown:Release (This=0x586b370) returned 0x1 [0325.590] CoGetContextToken (in: pToken=0x18e978 | out: pToken=0x18e978) returned 0x0 [0325.590] CoGetContextToken (in: pToken=0x18e8d8 | out: pToken=0x18e8d8) returned 0x0 [0325.590] WbemLocator:IUnknown:QueryInterface (in: This=0x586b370, riid=0x18e9a8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x586b370) returned 0x0 [0325.590] WbemLocator:IUnknown:AddRef (This=0x586b370) returned 0x3 [0325.590] WbemLocator:IUnknown:Release (This=0x586b370) returned 0x2 [0325.590] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872e30, puCount=0x18eb3c | out: puCount=0x18eb3c*=0x2) returned 0x0 [0325.591] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=8, puBuffLength=0x18eb38*=0x0, pszText=0x0 | out: puBuffLength=0x18eb38*=0x19, pszText=0x0) returned 0x0 [0325.591] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=8, puBuffLength=0x18eb38*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb38*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.591] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea00 | out: ppv=0x18ea00*=0x586b400) returned 0x0 [0325.591] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b400, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eaa8 | out: ppNamespace=0x18eaa8*=0x58c4ad8) returned 0x0 [0325.670] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4ad8, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e928 | out: ppvObject=0x18e928*=0x6c21e4) returned 0x0 [0325.670] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c21e4, pProxy=0x58c4ad8, pAuthnSvc=0x18e978, pAuthzSvc=0x18e974, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970, pImpLevel=0x18e960, pAuthInfo=0x18e964, pCapabilites=0x18e968 | out: pAuthnSvc=0x18e978*=0xa, pAuthzSvc=0x18e974*=0x0, pServerPrincName=0x18e96c, pAuthnLevel=0x18e970*=0x6, pImpLevel=0x18e960*=0x2, pAuthInfo=0x18e964, pCapabilites=0x18e968*=0x1) returned 0x0 [0325.670] WbemLocator:IUnknown:Release (This=0x6c21e4) returned 0x1 [0325.670] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4ad8, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e91c | out: ppvObject=0x18e91c*=0x6c2208) returned 0x0 [0325.670] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4ad8, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e908 | out: ppvObject=0x18e908*=0x6c21e4) returned 0x0 [0325.671] WbemLocator:IClientSecurity:SetBlanket (This=0x6c21e4, pProxy=0x58c4ad8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.671] WbemLocator:IUnknown:Release (This=0x6c21e4) returned 0x2 [0325.671] WbemLocator:IUnknown:Release (This=0x6c2208) returned 0x1 [0325.671] CoTaskMemFree (pv=0x586eda0) [0325.671] WbemLocator:IUnknown:Release (This=0x586b400) returned 0x0 [0325.671] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4ad8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e518 | out: ppvObject=0x18e518*=0x6c2208) returned 0x0 [0325.672] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e4d4 | out: ppvObject=0x18e4d4*=0x0) returned 0x80004002 [0325.673] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e2f4 | out: ppvObject=0x18e2f4*=0x0) returned 0x80004002 [0325.674] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4ad8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0cc | out: ppvObject=0x18e0cc*=0x0) returned 0x80004002 [0325.676] WbemLocator:IUnknown:AddRef (This=0x6c2208) returned 0x3 [0325.676] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de2c | out: ppvObject=0x18de2c*=0x0) returned 0x80004002 [0325.676] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dddc | out: ppvObject=0x18dddc*=0x0) returned 0x80004002 [0325.676] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dde8 | out: ppvObject=0x18dde8*=0x6c2164) returned 0x0 [0325.677] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2164, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18ddf0 | out: pCid=0x18ddf0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.677] WbemLocator:IUnknown:Release (This=0x6c2164) returned 0x3 [0325.677] CoGetContextToken (in: pToken=0x18de48 | out: pToken=0x18de48) returned 0x0 [0325.677] CoGetContextToken (in: pToken=0x18e250 | out: pToken=0x18e250) returned 0x0 [0325.677] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e2dc | out: ppvObject=0x18e2dc*=0x6c21ec) returned 0x0 [0325.677] WbemLocator:IRpcOptions:Query (in: This=0x6c21ec, pPrx=0x6c2208, dwProperty=2, pdwValue=0x18e2e8 | out: pdwValue=0x18e2e8) returned 0x80004002 [0325.677] WbemLocator:IUnknown:Release (This=0x6c21ec) returned 0x3 [0325.677] WbemLocator:IUnknown:Release (This=0x6c2208) returned 0x2 [0325.677] CoGetContextToken (in: pToken=0x18e828 | out: pToken=0x18e828) returned 0x0 [0325.677] CoGetContextToken (in: pToken=0x18e788 | out: pToken=0x18e788) returned 0x0 [0325.677] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x18e858*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e854 | out: ppvObject=0x18e854*=0x58c4ad8) returned 0x0 [0325.678] WbemLocator:IUnknown:AddRef (This=0x58c4ad8) returned 0x4 [0325.678] WbemLocator:IUnknown:Release (This=0x58c4ad8) returned 0x3 [0325.678] WbemLocator:IUnknown:Release (This=0x58c4ad8) returned 0x2 [0325.678] SysStringLen (param_1=0x0) returned 0x0 [0325.678] CoGetContextToken (in: pToken=0x18e840 | out: pToken=0x18e840) returned 0x0 [0325.678] WbemLocator:IUnknown:AddRef (This=0x6c2208) returned 0x3 [0325.678] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2208, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6d4 | out: ppvObject=0x18e6d4*=0x6c2208) returned 0x0 [0325.678] WbemLocator:IUnknown:Release (This=0x6c2208) returned 0x3 [0325.678] WbemLocator:IUnknown:Release (This=0x6c2208) returned 0x2 [0325.678] CoGetContextToken (in: pToken=0x18e938 | out: pToken=0x18e938) returned 0x0 [0325.678] WbemLocator:IUnknown:AddRef (This=0x58c4ad8) returned 0x3 [0325.678] IWbemServices:ExecQuery (in: This=0x58c4ad8, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x18eb48 | out: ppEnum=0x18eb48*=0x73c838) returned 0x0 [0325.708] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x73c83c) returned 0x0 [0325.708] IClientSecurity:QueryBlanket (in: This=0x73c83c, pProxy=0x73c838, pAuthnSvc=0x18e9f4, pAuthzSvc=0x18e9f0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec, pImpLevel=0x18e9dc, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4 | out: pAuthnSvc=0x18e9f4*=0xa, pAuthzSvc=0x18e9f0*=0x0, pServerPrincName=0x18e9e8, pAuthnLevel=0x18e9ec*=0x6, pImpLevel=0x18e9dc*=0x2, pAuthInfo=0x18e9e0, pCapabilites=0x18e9e4*=0x1) returned 0x0 [0325.708] IUnknown:Release (This=0x73c83c) returned 0x1 [0325.708] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e998 | out: ppvObject=0x18e998*=0x6c1c08) returned 0x0 [0325.708] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e984 | out: ppvObject=0x18e984*=0x73c83c) returned 0x0 [0325.708] IClientSecurity:SetBlanket (This=0x73c83c, pProxy=0x73c838, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.711] IUnknown:Release (This=0x73c83c) returned 0x2 [0325.711] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0325.711] CoTaskMemFree (pv=0x6e9d40) [0325.712] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x6c1c08) returned 0x0 [0325.712] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e54c | out: ppvObject=0x18e54c*=0x0) returned 0x80004002 [0325.713] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x0) returned 0x80004002 [0325.714] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e144 | out: ppvObject=0x18e144*=0x0) returned 0x80004002 [0325.715] WbemLocator:IUnknown:AddRef (This=0x6c1c08) returned 0x3 [0325.715] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dea4 | out: ppvObject=0x18dea4*=0x0) returned 0x80004002 [0325.715] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de54 | out: ppvObject=0x18de54*=0x0) returned 0x80004002 [0325.715] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de60 | out: ppvObject=0x18de60*=0x6c1b64) returned 0x0 [0325.715] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1b64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de68 | out: pCid=0x18de68*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.715] WbemLocator:IUnknown:Release (This=0x6c1b64) returned 0x3 [0325.715] CoGetContextToken (in: pToken=0x18dec0 | out: pToken=0x18dec0) returned 0x0 [0325.715] CoGetContextToken (in: pToken=0x18e2c8 | out: pToken=0x18e2c8) returned 0x0 [0325.715] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e354 | out: ppvObject=0x18e354*=0x6c1bec) returned 0x0 [0325.715] WbemLocator:IRpcOptions:Query (in: This=0x6c1bec, pPrx=0x6c1c08, dwProperty=2, pdwValue=0x18e360 | out: pdwValue=0x18e360) returned 0x80004002 [0325.716] WbemLocator:IUnknown:Release (This=0x6c1bec) returned 0x3 [0325.716] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x2 [0325.716] CoGetContextToken (in: pToken=0x18e8a0 | out: pToken=0x18e8a0) returned 0x0 [0325.716] CoGetContextToken (in: pToken=0x18e800 | out: pToken=0x18e800) returned 0x0 [0325.716] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x18e8d0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8cc | out: ppvObject=0x18e8cc*=0x73c838) returned 0x0 [0325.716] IUnknown:AddRef (This=0x73c838) returned 0x4 [0325.716] IUnknown:Release (This=0x73c838) returned 0x3 [0325.716] IUnknown:Release (This=0x73c838) returned 0x2 [0325.716] WbemLocator:IUnknown:Release (This=0x58c4ad8) returned 0x2 [0325.716] SysStringLen (param_1=0x0) returned 0x0 [0325.716] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5872e30, puCount=0x18eb94 | out: puCount=0x18eb94*=0x2) returned 0x0 [0325.716] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18eb90*=0x0, pszText=0x0 | out: puBuffLength=0x18eb90*=0x19, pszText=0x0) returned 0x0 [0325.716] WbemDefPath:IWbemPath:GetText (in: This=0x5872e30, lFlags=4, puBuffLength=0x18eb90*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x18eb90*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0325.716] CoGetContextToken (in: pToken=0x18e9e0 | out: pToken=0x18e9e0) returned 0x0 [0325.716] IUnknown:AddRef (This=0x73c838) returned 0x3 [0325.717] IEnumWbemClassObject:Clone (in: This=0x73c838, ppEnum=0x18eba0 | out: ppEnum=0x18eba0*=0x73bfa0) returned 0x0 [0325.719] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x73bfa4) returned 0x0 [0325.719] IClientSecurity:QueryBlanket (in: This=0x73bfa4, pProxy=0x73bfa0, pAuthnSvc=0x18eaac, pAuthzSvc=0x18eaa8, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4, pImpLevel=0x18ea94, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c | out: pAuthnSvc=0x18eaac*=0xa, pAuthzSvc=0x18eaa8*=0x0, pServerPrincName=0x18eaa0, pAuthnLevel=0x18eaa4*=0x6, pImpLevel=0x18ea94*=0x2, pAuthInfo=0x18ea98, pCapabilites=0x18ea9c*=0x1) returned 0x0 [0325.719] IUnknown:Release (This=0x73bfa4) returned 0x1 [0325.719] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea50 | out: ppvObject=0x18ea50*=0x6c2008) returned 0x0 [0325.719] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea3c | out: ppvObject=0x18ea3c*=0x73bfa4) returned 0x0 [0325.719] IClientSecurity:SetBlanket (This=0x73bfa4, pProxy=0x73bfa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.722] IUnknown:Release (This=0x73bfa4) returned 0x2 [0325.723] WbemLocator:IUnknown:Release (This=0x6c2008) returned 0x1 [0325.723] CoTaskMemFree (pv=0x6e9bc0) [0325.723] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e638 | out: ppvObject=0x18e638*=0x6c2008) returned 0x0 [0325.723] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e5f4 | out: ppvObject=0x18e5f4*=0x0) returned 0x80004002 [0325.726] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x0) returned 0x80004002 [0325.726] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e1ec | out: ppvObject=0x18e1ec*=0x0) returned 0x80004002 [0325.727] WbemLocator:IUnknown:AddRef (This=0x6c2008) returned 0x3 [0325.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df4c | out: ppvObject=0x18df4c*=0x0) returned 0x80004002 [0325.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18defc | out: ppvObject=0x18defc*=0x0) returned 0x80004002 [0325.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df08 | out: ppvObject=0x18df08*=0x6c1f64) returned 0x0 [0325.728] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1f64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df10 | out: pCid=0x18df10*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.728] WbemLocator:IUnknown:Release (This=0x6c1f64) returned 0x3 [0325.728] CoGetContextToken (in: pToken=0x18df68 | out: pToken=0x18df68) returned 0x0 [0325.728] CoGetContextToken (in: pToken=0x18e370 | out: pToken=0x18e370) returned 0x0 [0325.728] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e3fc | out: ppvObject=0x18e3fc*=0x6c1fec) returned 0x0 [0325.728] WbemLocator:IRpcOptions:Query (in: This=0x6c1fec, pPrx=0x6c2008, dwProperty=2, pdwValue=0x18e408 | out: pdwValue=0x18e408) returned 0x80004002 [0325.728] WbemLocator:IUnknown:Release (This=0x6c1fec) returned 0x3 [0325.729] WbemLocator:IUnknown:Release (This=0x6c2008) returned 0x2 [0325.729] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0325.729] CoGetContextToken (in: pToken=0x18e8a8 | out: pToken=0x18e8a8) returned 0x0 [0325.729] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2008, riid=0x18e978*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e974 | out: ppvObject=0x18e974*=0x73bfa0) returned 0x0 [0325.729] IUnknown:AddRef (This=0x73bfa0) returned 0x4 [0325.729] IUnknown:Release (This=0x73bfa0) returned 0x3 [0325.729] IUnknown:Release (This=0x73bfa0) returned 0x2 [0325.729] IUnknown:Release (This=0x73c838) returned 0x2 [0325.729] SysStringLen (param_1=0x0) returned 0x0 [0325.729] IEnumWbemClassObject:Reset (This=0x73bfa0) returned 0x0 [0325.730] CoTaskMemAlloc (cb=0x4) returned 0x586b410 [0325.730] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b410, puReturned=0x23563f0 | out: apObjects=0x586b410*=0x0, puReturned=0x23563f0*=0x0) returned 0x1 [0325.732] CoTaskMemFree (pv=0x586b410) [0325.732] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.732] WbemLocator:IUnknown:Release (This=0x6c2008) returned 0x1 [0325.732] IUnknown:Release (This=0x73bfa0) returned 0x0 [0325.734] CoGetContextToken (in: pToken=0x18eac0 | out: pToken=0x18eac0) returned 0x0 [0325.734] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0325.734] IUnknown:Release (This=0x73c838) returned 0x0 [0325.749] GetCurrentProcessId () returned 0xad0 [0325.750] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32454f0, Length=0x20000, ResultLength=0x18ec0c | out: SystemInformation=0x32454f0, ResultLength=0x18ec0c*=0x14900) returned 0x0 [0325.779] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebf4 | out: puCount=0x18ebf4*=0x2) returned 0x0 [0325.779] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebf0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebf0*=0xf, pszText=0x0) returned 0x0 [0325.779] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebf0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebf0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0325.779] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb7c | out: ppv=0x18eb7c*=0x692bc4) returned 0x0 [0325.779] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb74 | out: pAptType=0x18eb74*=1) returned 0x0 [0325.780] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb78 | out: ppvObject=0x18eb78*=0x0) returned 0x80004002 [0325.780] IUnknown:Release (This=0x692bc4) returned 0x1 [0325.782] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e788 | out: ppv=0x18e788*=0x58cb018) returned 0x0 [0325.782] WbemLocator:IUnknown:QueryInterface (in: This=0x58cb018, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x0) returned 0x80004002 [0325.782] WbemLocator:IClassFactory:CreateInstance (in: This=0x58cb018, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b0 | out: ppvObject=0x18e9b0*=0x586b350) returned 0x0 [0325.783] WbemLocator:IUnknown:Release (This=0x58cb018) returned 0x0 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5d4 | out: ppvObject=0x18e5d4*=0x586b350) returned 0x0 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x0) returned 0x80004002 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e184 | out: ppvObject=0x18e184*=0x0) returned 0x80004002 [0325.783] WbemLocator:IUnknown:AddRef (This=0x586b350) returned 0x3 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dee4 | out: ppvObject=0x18dee4*=0x0) returned 0x80004002 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de94 | out: ppvObject=0x18de94*=0x0) returned 0x80004002 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dea0 | out: ppvObject=0x18dea0*=0x0) returned 0x80004002 [0325.783] CoGetContextToken (in: pToken=0x18df00 | out: pToken=0x18df00) returned 0x0 [0325.783] CoGetContextToken (in: pToken=0x18e308 | out: pToken=0x18e308) returned 0x0 [0325.783] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e394 | out: ppvObject=0x18e394*=0x0) returned 0x80004002 [0325.784] WbemLocator:IUnknown:Release (This=0x586b350) returned 0x2 [0325.784] WbemLocator:IUnknown:Release (This=0x586b350) returned 0x1 [0325.784] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0325.784] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0325.784] WbemLocator:IUnknown:QueryInterface (in: This=0x586b350, riid=0x18e9c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x586b350) returned 0x0 [0325.784] WbemLocator:IUnknown:AddRef (This=0x586b350) returned 0x3 [0325.784] WbemLocator:IUnknown:Release (This=0x586b350) returned 0x2 [0325.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb58 | out: puCount=0x18eb58*=0x2) returned 0x0 [0325.784] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb54*=0x0, pszText=0x0 | out: puBuffLength=0x18eb54*=0xf, pszText=0x0) returned 0x0 [0325.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb54*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb54*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0325.785] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea30 | out: ppv=0x18ea30*=0x586b2d0) returned 0x0 [0325.785] WbemLocator:IWbemLocator:ConnectServer (in: This=0x586b2d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eac4 | out: ppNamespace=0x18eac4*=0x58c4cb8) returned 0x0 [0325.828] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4cb8, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e958 | out: ppvObject=0x18e958*=0x6c1ee4) returned 0x0 [0325.829] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c1ee4, pProxy=0x58c4cb8, pAuthnSvc=0x18e9a8, pAuthzSvc=0x18e9a4, pServerPrincName=0x18e99c, pAuthnLevel=0x18e9a0, pImpLevel=0x18e990, pAuthInfo=0x18e994, pCapabilites=0x18e998 | out: pAuthnSvc=0x18e9a8*=0xa, pAuthzSvc=0x18e9a4*=0x0, pServerPrincName=0x18e99c, pAuthnLevel=0x18e9a0*=0x6, pImpLevel=0x18e990*=0x2, pAuthInfo=0x18e994, pCapabilites=0x18e998*=0x1) returned 0x0 [0325.829] WbemLocator:IUnknown:Release (This=0x6c1ee4) returned 0x1 [0325.829] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4cb8, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e94c | out: ppvObject=0x18e94c*=0x6c1f08) returned 0x0 [0325.829] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4cb8, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e938 | out: ppvObject=0x18e938*=0x6c1ee4) returned 0x0 [0325.829] WbemLocator:IClientSecurity:SetBlanket (This=0x6c1ee4, pProxy=0x58c4cb8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.829] WbemLocator:IUnknown:Release (This=0x6c1ee4) returned 0x2 [0325.829] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x1 [0325.830] CoTaskMemFree (pv=0x6e9da0) [0325.830] WbemLocator:IUnknown:Release (This=0x586b2d0) returned 0x0 [0325.830] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4cb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e548 | out: ppvObject=0x18e548*=0x6c1f08) returned 0x0 [0325.830] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e504 | out: ppvObject=0x18e504*=0x0) returned 0x80004002 [0325.832] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e324 | out: ppvObject=0x18e324*=0x0) returned 0x80004002 [0325.833] WbemLocator:IUnknown:QueryInterface (in: This=0x58c4cb8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0fc | out: ppvObject=0x18e0fc*=0x0) returned 0x80004002 [0325.834] WbemLocator:IUnknown:AddRef (This=0x6c1f08) returned 0x3 [0325.834] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de5c | out: ppvObject=0x18de5c*=0x0) returned 0x80004002 [0325.834] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de0c | out: ppvObject=0x18de0c*=0x0) returned 0x80004002 [0325.834] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de18 | out: ppvObject=0x18de18*=0x6c1e64) returned 0x0 [0325.834] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1e64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de20 | out: pCid=0x18de20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.834] WbemLocator:IUnknown:Release (This=0x6c1e64) returned 0x3 [0325.834] CoGetContextToken (in: pToken=0x18de78 | out: pToken=0x18de78) returned 0x0 [0325.835] CoGetContextToken (in: pToken=0x18e280 | out: pToken=0x18e280) returned 0x0 [0325.835] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e30c | out: ppvObject=0x18e30c*=0x6c1eec) returned 0x0 [0325.835] WbemLocator:IRpcOptions:Query (in: This=0x6c1eec, pPrx=0x6c1f08, dwProperty=2, pdwValue=0x18e318 | out: pdwValue=0x18e318) returned 0x80004002 [0325.835] WbemLocator:IUnknown:Release (This=0x6c1eec) returned 0x3 [0325.835] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x2 [0325.835] CoGetContextToken (in: pToken=0x18e858 | out: pToken=0x18e858) returned 0x0 [0325.835] CoGetContextToken (in: pToken=0x18e7b8 | out: pToken=0x18e7b8) returned 0x0 [0325.835] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x18e888*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e884 | out: ppvObject=0x18e884*=0x58c4cb8) returned 0x0 [0325.835] WbemLocator:IUnknown:AddRef (This=0x58c4cb8) returned 0x4 [0325.835] WbemLocator:IUnknown:Release (This=0x58c4cb8) returned 0x3 [0325.835] WbemLocator:IUnknown:Release (This=0x58c4cb8) returned 0x2 [0325.835] SysStringLen (param_1=0x0) returned 0x0 [0325.835] CoGetContextToken (in: pToken=0x18e860 | out: pToken=0x18e860) returned 0x0 [0325.835] WbemLocator:IUnknown:AddRef (This=0x6c1f08) returned 0x3 [0325.835] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1f08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6f4 | out: ppvObject=0x18e6f4*=0x6c1f08) returned 0x0 [0325.836] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x3 [0325.836] WbemLocator:IUnknown:Release (This=0x6c1f08) returned 0x2 [0325.836] CoGetContextToken (in: pToken=0x18e930 | out: pToken=0x18e930) returned 0x0 [0325.836] WbemLocator:IUnknown:AddRef (This=0x58c4cb8) returned 0x3 [0325.836] IWbemServices:ExecQuery (in: This=0x58c4cb8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x18eb64 | out: ppEnum=0x18eb64*=0x73c838) returned 0x0 [0325.881] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e99c | out: ppvObject=0x18e99c*=0x73c83c) returned 0x0 [0325.882] IClientSecurity:QueryBlanket (in: This=0x73c83c, pProxy=0x73c838, pAuthnSvc=0x18e9ec, pAuthzSvc=0x18e9e8, pServerPrincName=0x18e9e0, pAuthnLevel=0x18e9e4, pImpLevel=0x18e9d4, pAuthInfo=0x18e9d8, pCapabilites=0x18e9dc | out: pAuthnSvc=0x18e9ec*=0xa, pAuthzSvc=0x18e9e8*=0x0, pServerPrincName=0x18e9e0, pAuthnLevel=0x18e9e4*=0x6, pImpLevel=0x18e9d4*=0x2, pAuthInfo=0x18e9d8, pCapabilites=0x18e9dc*=0x1) returned 0x0 [0325.882] IUnknown:Release (This=0x73c83c) returned 0x1 [0325.882] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e990 | out: ppvObject=0x18e990*=0x6c1c08) returned 0x0 [0325.882] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e97c | out: ppvObject=0x18e97c*=0x73c83c) returned 0x0 [0325.882] IClientSecurity:SetBlanket (This=0x73c83c, pProxy=0x73c838, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.885] IUnknown:Release (This=0x73c83c) returned 0x2 [0325.885] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0325.885] CoTaskMemFree (pv=0x6e9f20) [0325.885] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e588 | out: ppvObject=0x18e588*=0x6c1c08) returned 0x0 [0325.886] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e544 | out: ppvObject=0x18e544*=0x0) returned 0x80004002 [0325.886] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e364 | out: ppvObject=0x18e364*=0x0) returned 0x80004002 [0325.887] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e13c | out: ppvObject=0x18e13c*=0x0) returned 0x80004002 [0325.888] WbemLocator:IUnknown:AddRef (This=0x6c1c08) returned 0x3 [0325.888] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de9c | out: ppvObject=0x18de9c*=0x0) returned 0x80004002 [0325.888] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de4c | out: ppvObject=0x18de4c*=0x0) returned 0x80004002 [0325.888] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de58 | out: ppvObject=0x18de58*=0x6c1b64) returned 0x0 [0325.888] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1b64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de60 | out: pCid=0x18de60*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.888] WbemLocator:IUnknown:Release (This=0x6c1b64) returned 0x3 [0325.889] CoGetContextToken (in: pToken=0x18deb8 | out: pToken=0x18deb8) returned 0x0 [0325.889] CoGetContextToken (in: pToken=0x18e2c0 | out: pToken=0x18e2c0) returned 0x0 [0325.889] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e34c | out: ppvObject=0x18e34c*=0x6c1bec) returned 0x0 [0325.889] WbemLocator:IRpcOptions:Query (in: This=0x6c1bec, pPrx=0x6c1c08, dwProperty=2, pdwValue=0x18e358 | out: pdwValue=0x18e358) returned 0x80004002 [0325.889] WbemLocator:IUnknown:Release (This=0x6c1bec) returned 0x3 [0325.889] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x2 [0325.889] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0325.889] CoGetContextToken (in: pToken=0x18e7f8 | out: pToken=0x18e7f8) returned 0x0 [0325.889] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1c08, riid=0x18e8c8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8c4 | out: ppvObject=0x18e8c4*=0x73c838) returned 0x0 [0325.889] IUnknown:AddRef (This=0x73c838) returned 0x4 [0325.889] IUnknown:Release (This=0x73c838) returned 0x3 [0325.890] IUnknown:Release (This=0x73c838) returned 0x2 [0325.890] WbemLocator:IUnknown:Release (This=0x58c4cb8) returned 0x2 [0325.890] SysStringLen (param_1=0x0) returned 0x0 [0325.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb0 | out: puCount=0x18ebb0*=0x2) returned 0x0 [0325.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0x0, pszText=0x0 | out: puBuffLength=0x18ebac*=0xf, pszText=0x0) returned 0x0 [0325.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0325.890] CoGetContextToken (in: pToken=0x18ea00 | out: pToken=0x18ea00) returned 0x0 [0325.890] IUnknown:AddRef (This=0x73c838) returned 0x3 [0325.890] IEnumWbemClassObject:Clone (in: This=0x73c838, ppEnum=0x18ebbc | out: ppEnum=0x18ebbc*=0x73bfa0) returned 0x0 [0325.892] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea78 | out: ppvObject=0x18ea78*=0x73bfa4) returned 0x0 [0325.893] IClientSecurity:QueryBlanket (in: This=0x73bfa4, pProxy=0x73bfa0, pAuthnSvc=0x18eac8, pAuthzSvc=0x18eac4, pServerPrincName=0x18eabc, pAuthnLevel=0x18eac0, pImpLevel=0x18eab0, pAuthInfo=0x18eab4, pCapabilites=0x18eab8 | out: pAuthnSvc=0x18eac8*=0xa, pAuthzSvc=0x18eac4*=0x0, pServerPrincName=0x18eabc, pAuthnLevel=0x18eac0*=0x6, pImpLevel=0x18eab0*=0x2, pAuthInfo=0x18eab4, pCapabilites=0x18eab8*=0x1) returned 0x0 [0325.893] IUnknown:Release (This=0x73bfa4) returned 0x1 [0325.893] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea6c | out: ppvObject=0x18ea6c*=0x6c2908) returned 0x0 [0325.893] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea58 | out: ppvObject=0x18ea58*=0x73bfa4) returned 0x0 [0325.893] IClientSecurity:SetBlanket (This=0x73bfa4, pProxy=0x73bfa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0325.896] IUnknown:Release (This=0x73bfa4) returned 0x2 [0325.896] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0325.896] CoTaskMemFree (pv=0x6e9bc0) [0325.896] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e654 | out: ppvObject=0x18e654*=0x6c2908) returned 0x0 [0325.897] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e610 | out: ppvObject=0x18e610*=0x0) returned 0x80004002 [0325.941] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e42c | out: ppvObject=0x18e42c*=0x0) returned 0x80004002 [0325.942] IUnknown:QueryInterface (in: This=0x73bfa0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0325.943] WbemLocator:IUnknown:AddRef (This=0x6c2908) returned 0x3 [0325.943] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df64 | out: ppvObject=0x18df64*=0x0) returned 0x80004002 [0325.943] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df14 | out: ppvObject=0x18df14*=0x0) returned 0x80004002 [0325.943] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df20 | out: ppvObject=0x18df20*=0x6c2864) returned 0x0 [0325.943] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df28 | out: pCid=0x18df28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0325.943] WbemLocator:IUnknown:Release (This=0x6c2864) returned 0x3 [0325.943] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0325.944] CoGetContextToken (in: pToken=0x18e388 | out: pToken=0x18e388) returned 0x0 [0325.944] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x6c28ec) returned 0x0 [0325.944] WbemLocator:IRpcOptions:Query (in: This=0x6c28ec, pPrx=0x6c2908, dwProperty=2, pdwValue=0x18e420 | out: pdwValue=0x18e420) returned 0x80004002 [0325.944] WbemLocator:IUnknown:Release (This=0x6c28ec) returned 0x3 [0325.944] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x2 [0325.944] CoGetContextToken (in: pToken=0x18e968 | out: pToken=0x18e968) returned 0x0 [0325.944] CoGetContextToken (in: pToken=0x18e8c8 | out: pToken=0x18e8c8) returned 0x0 [0325.944] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2908, riid=0x18e998*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0x73bfa0) returned 0x0 [0325.944] IUnknown:AddRef (This=0x73bfa0) returned 0x4 [0325.944] IUnknown:Release (This=0x73bfa0) returned 0x3 [0325.944] IUnknown:Release (This=0x73bfa0) returned 0x2 [0325.944] IUnknown:Release (This=0x73c838) returned 0x2 [0325.945] SysStringLen (param_1=0x0) returned 0x0 [0325.945] IEnumWbemClassObject:Reset (This=0x73bfa0) returned 0x0 [0325.946] CoTaskMemAlloc (cb=0x4) returned 0x586b410 [0325.946] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b410, puReturned=0x2377db0 | out: apObjects=0x586b410*=0x6cae00, puReturned=0x2377db0*=0x1) returned 0x0 [0327.875] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x6cae00) returned 0x0 [0327.875] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0327.875] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0327.875] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0327.876] IUnknown:AddRef (This=0x6cae00) returned 0x3 [0327.876] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0327.876] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0327.876] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x6cae04) returned 0x0 [0327.876] IMarshal:GetUnmarshalClass (in: This=0x6cae04, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0327.876] IUnknown:Release (This=0x6cae04) returned 0x3 [0327.876] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0327.877] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0327.877] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0327.877] IUnknown:Release (This=0x6cae00) returned 0x2 [0327.877] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0327.878] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0327.878] IUnknown:QueryInterface (in: This=0x6cae00, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x6cae00) returned 0x0 [0327.878] IUnknown:AddRef (This=0x6cae00) returned 0x4 [0327.878] IUnknown:Release (This=0x6cae00) returned 0x3 [0327.879] IUnknown:Release (This=0x6cae00) returned 0x2 [0327.879] CoTaskMemFree (pv=0x586b410) [0327.879] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0327.879] IUnknown:AddRef (This=0x6cae00) returned 0x3 [0327.879] IWbemClassObject:Get (in: This=0x6cae00, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0327.880] IWbemClassObject:Get (in: This=0x6cae00, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0327.881] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0327.881] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x5c [0327.881] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0327.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0327.881] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0327.882] IUnknown:Release (This=0x692bc4) returned 0x1 [0327.884] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0327.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0327.885] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58729d0) returned 0x0 [0327.885] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0327.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58729d0) returned 0x0 [0327.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0327.885] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0327.886] WbemDefPath:IUnknown:AddRef (This=0x58729d0) returned 0x3 [0327.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0327.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0327.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb3d8) returned 0x0 [0327.886] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb3d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0327.886] WbemDefPath:IUnknown:Release (This=0x58cb3d8) returned 0x3 [0327.886] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0327.886] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0327.886] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0327.887] WbemDefPath:IUnknown:Release (This=0x58729d0) returned 0x2 [0327.887] WbemDefPath:IUnknown:Release (This=0x58729d0) returned 0x1 [0327.887] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0327.887] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0327.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x58729d0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58729d0) returned 0x0 [0327.887] WbemDefPath:IUnknown:AddRef (This=0x58729d0) returned 0x3 [0327.887] WbemDefPath:IUnknown:Release (This=0x58729d0) returned 0x2 [0327.887] WbemDefPath:IWbemPath:SetText (This=0x58729d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"452\"") returned 0x0 [0327.887] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0327.887] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0327.888] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.888] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.888] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.888] IWbemClassObject:Get (in: This=0x6cae00, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378644*=0, plFlavor=0x2378648*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c4, varVal2=0x0), pType=0x2378644*=19, plFlavor=0x2378648*=0) returned 0x0 [0327.889] IWbemClassObject:Get (in: This=0x6cae00, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378644*=19, plFlavor=0x2378648*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c4, varVal2=0x0), pType=0x2378644*=19, plFlavor=0x2378648*=0) returned 0x0 [0327.889] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.889] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.890] IWbemClassObject:Get (in: This=0x6cae00, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378744*=0, plFlavor=0x2378748*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2378744*=8, plFlavor=0x2378748*=0) returned 0x0 [0327.890] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0327.890] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0327.890] IWbemClassObject:Get (in: This=0x6cae00, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378744*=8, plFlavor=0x2378748*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x2378744*=8, plFlavor=0x2378748*=0) returned 0x0 [0327.890] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0327.890] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0327.890] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.890] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.891] IWbemClassObject:Get (in: This=0x6cae00, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378878*=0, plFlavor=0x237887c*=0 | out: pVal=0x18ebb0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378878*=8, plFlavor=0x237887c*=32) returned 0x0 [0327.891] IWbemClassObject:Get (in: This=0x6cae00, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378878*=8, plFlavor=0x237887c*=32 | out: pVal=0x18ebb8*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2378878*=8, plFlavor=0x237887c*=32) returned 0x0 [0327.892] CoTaskMemAlloc (cb=0x4) returned 0x586b440 [0327.892] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b440, puReturned=0x2377db0 | out: apObjects=0x586b440*=0x6cc120, puReturned=0x2377db0*=0x1) returned 0x0 [0327.896] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x6cc120) returned 0x0 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0327.897] IUnknown:AddRef (This=0x6cc120) returned 0x3 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0327.897] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x6cc124) returned 0x0 [0327.897] IMarshal:GetUnmarshalClass (in: This=0x6cc124, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0327.897] IUnknown:Release (This=0x6cc124) returned 0x3 [0327.897] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0327.898] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0327.898] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0327.898] IUnknown:Release (This=0x6cc120) returned 0x2 [0327.898] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0327.898] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0327.898] IUnknown:QueryInterface (in: This=0x6cc120, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x6cc120) returned 0x0 [0327.898] IUnknown:AddRef (This=0x6cc120) returned 0x4 [0327.898] IUnknown:Release (This=0x6cc120) returned 0x3 [0327.898] IUnknown:Release (This=0x6cc120) returned 0x2 [0327.898] CoTaskMemFree (pv=0x586b440) [0327.898] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0327.898] IUnknown:AddRef (This=0x6cc120) returned 0x3 [0327.899] IWbemClassObject:Get (in: This=0x6cc120, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0327.899] IWbemClassObject:Get (in: This=0x6cc120, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0327.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0327.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x5c [0327.899] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0327.900] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0327.900] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0327.900] IUnknown:Release (This=0x692bc4) returned 0x1 [0327.901] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0327.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0327.901] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873060) returned 0x0 [0327.901] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873060) returned 0x0 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0327.902] WbemDefPath:IUnknown:AddRef (This=0x5873060) returned 0x3 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0327.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb558) returned 0x0 [0327.902] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb558, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0327.902] WbemDefPath:IUnknown:Release (This=0x58cb558) returned 0x3 [0327.903] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0327.903] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0327.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0327.903] WbemDefPath:IUnknown:Release (This=0x5873060) returned 0x2 [0327.903] WbemDefPath:IUnknown:Release (This=0x5873060) returned 0x1 [0327.903] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0327.903] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0327.903] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873060, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873060) returned 0x0 [0327.903] WbemDefPath:IUnknown:AddRef (This=0x5873060) returned 0x3 [0327.903] WbemDefPath:IUnknown:Release (This=0x5873060) returned 0x2 [0327.903] WbemDefPath:IWbemPath:SetText (This=0x5873060, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"504\"") returned 0x0 [0327.903] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.904] IWbemClassObject:Get (in: This=0x6cc120, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379194*=0, plFlavor=0x2379198*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f8, varVal2=0x0), pType=0x2379194*=19, plFlavor=0x2379198*=0) returned 0x0 [0327.904] IWbemClassObject:Get (in: This=0x6cc120, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379194*=19, plFlavor=0x2379198*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f8, varVal2=0x0), pType=0x2379194*=19, plFlavor=0x2379198*=0) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.904] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.905] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.905] IWbemClassObject:Get (in: This=0x6cc120, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379294*=0, plFlavor=0x2379298*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2379294*=8, plFlavor=0x2379298*=0) returned 0x0 [0327.905] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.905] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.905] IWbemClassObject:Get (in: This=0x6cc120, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379294*=8, plFlavor=0x2379298*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x2379294*=8, plFlavor=0x2379298*=0) returned 0x0 [0327.905] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.905] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.905] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.906] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.906] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.906] IWbemClassObject:Get (in: This=0x6cc120, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23793d8*=0, plFlavor=0x23793dc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x23793d8*=8, plFlavor=0x23793dc*=0) returned 0x0 [0327.906] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.906] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.906] IWbemClassObject:Get (in: This=0x6cc120, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23793d8*=8, plFlavor=0x23793dc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x23793d8*=8, plFlavor=0x23793dc*=0) returned 0x0 [0327.906] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.906] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0327.907] CoTaskMemAlloc (cb=0x4) returned 0x586b440 [0327.907] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b440, puReturned=0x2377db0 | out: apObjects=0x586b440*=0x58ea1f0, puReturned=0x2377db0*=0x1) returned 0x0 [0327.959] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea1f0) returned 0x0 [0327.959] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0327.959] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0327.959] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0327.960] IUnknown:AddRef (This=0x58ea1f0) returned 0x3 [0327.960] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0327.960] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0327.960] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea1f4) returned 0x0 [0327.960] IMarshal:GetUnmarshalClass (in: This=0x58ea1f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0327.960] IUnknown:Release (This=0x58ea1f4) returned 0x3 [0327.960] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0327.960] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0327.960] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0327.961] IUnknown:Release (This=0x58ea1f0) returned 0x2 [0327.961] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0327.961] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0327.961] IUnknown:QueryInterface (in: This=0x58ea1f0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea1f0) returned 0x0 [0327.961] IUnknown:AddRef (This=0x58ea1f0) returned 0x4 [0327.961] IUnknown:Release (This=0x58ea1f0) returned 0x3 [0327.961] IUnknown:Release (This=0x58ea1f0) returned 0x2 [0327.961] CoTaskMemFree (pv=0x586b440) [0327.961] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0327.961] IUnknown:AddRef (This=0x58ea1f0) returned 0x3 [0327.961] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0327.962] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0327.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0327.962] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x5c [0327.962] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0327.962] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0327.962] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0327.962] IUnknown:Release (This=0x692bc4) returned 0x1 [0327.964] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b440) returned 0x0 [0327.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b440, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0327.964] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b440, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872570) returned 0x0 [0327.964] WbemDefPath:IUnknown:Release (This=0x586b440) returned 0x0 [0327.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872570) returned 0x0 [0327.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0327.964] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0327.965] WbemDefPath:IUnknown:AddRef (This=0x5872570) returned 0x3 [0327.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0327.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0327.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb678) returned 0x0 [0327.965] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb678, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0327.965] WbemDefPath:IUnknown:Release (This=0x58cb678) returned 0x3 [0327.965] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0327.965] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0327.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0327.966] WbemDefPath:IUnknown:Release (This=0x5872570) returned 0x2 [0327.966] WbemDefPath:IUnknown:Release (This=0x5872570) returned 0x1 [0327.966] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0327.966] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0327.966] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872570, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872570) returned 0x0 [0327.966] WbemDefPath:IUnknown:AddRef (This=0x5872570) returned 0x3 [0327.966] WbemDefPath:IUnknown:Release (This=0x5872570) returned 0x2 [0327.966] WbemDefPath:IWbemPath:SetText (This=0x5872570, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"756\"") returned 0x0 [0327.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0327.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0327.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.966] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.966] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.967] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379d48*=0, plFlavor=0x2379d4c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f4, varVal2=0x0), pType=0x2379d48*=19, plFlavor=0x2379d4c*=0) returned 0x0 [0327.967] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379d48*=19, plFlavor=0x2379d4c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f4, varVal2=0x0), pType=0x2379d48*=19, plFlavor=0x2379d4c*=0) returned 0x0 [0327.967] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.967] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.967] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379e48*=0, plFlavor=0x2379e4c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2379e48*=8, plFlavor=0x2379e4c*=0) returned 0x0 [0327.968] SysStringByteLen (bstr="dwm.exe") returned 0xe [0327.968] SysStringByteLen (bstr="dwm.exe") returned 0xe [0327.968] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379e48*=8, plFlavor=0x2379e4c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x2379e48*=8, plFlavor=0x2379e4c*=0) returned 0x0 [0327.968] SysStringByteLen (bstr="dwm.exe") returned 0xe [0327.968] SysStringByteLen (bstr="dwm.exe") returned 0xe [0327.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.968] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.968] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.968] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379f74*=0, plFlavor=0x2379f78*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x2379f74*=8, plFlavor=0x2379f78*=0) returned 0x0 [0327.969] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0327.969] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0327.969] IWbemClassObject:Get (in: This=0x58ea1f0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2379f74*=8, plFlavor=0x2379f78*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"dwm.exe\"", varVal2=0x0), pType=0x2379f74*=8, plFlavor=0x2379f78*=0) returned 0x0 [0327.969] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0327.969] SysStringByteLen (bstr="\"dwm.exe\"") returned 0x12 [0327.969] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0327.969] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58eb1e0, puReturned=0x2377db0*=0x1) returned 0x0 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eb1e0) returned 0x0 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0327.972] IUnknown:AddRef (This=0x58eb1e0) returned 0x3 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0327.972] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eb1e4) returned 0x0 [0327.973] IMarshal:GetUnmarshalClass (in: This=0x58eb1e4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0327.973] IUnknown:Release (This=0x58eb1e4) returned 0x3 [0327.973] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0327.973] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0327.973] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0327.973] IUnknown:Release (This=0x58eb1e0) returned 0x2 [0327.973] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0327.973] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0327.973] IUnknown:QueryInterface (in: This=0x58eb1e0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eb1e0) returned 0x0 [0327.973] IUnknown:AddRef (This=0x58eb1e0) returned 0x4 [0327.974] IUnknown:Release (This=0x58eb1e0) returned 0x3 [0327.974] IUnknown:Release (This=0x58eb1e0) returned 0x2 [0327.974] CoTaskMemFree (pv=0x586b460) [0327.974] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0327.974] IUnknown:AddRef (This=0x58eb1e0) returned 0x3 [0327.974] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0327.974] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0327.974] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0327.974] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x5e [0327.975] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0327.975] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0327.975] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0327.975] IUnknown:Release (This=0x692bc4) returned 0x1 [0327.976] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0327.977] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58726c0) returned 0x0 [0327.977] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58726c0) returned 0x0 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0327.977] WbemDefPath:IUnknown:AddRef (This=0x58726c0) returned 0x3 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0327.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0327.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb7f8) returned 0x0 [0327.978] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb7f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0327.978] WbemDefPath:IUnknown:Release (This=0x58cb7f8) returned 0x3 [0327.978] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0327.978] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0327.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0327.978] WbemDefPath:IUnknown:Release (This=0x58726c0) returned 0x2 [0327.978] WbemDefPath:IUnknown:Release (This=0x58726c0) returned 0x1 [0327.978] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0327.978] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0327.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x58726c0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58726c0) returned 0x0 [0327.979] WbemDefPath:IUnknown:AddRef (This=0x58726c0) returned 0x3 [0327.979] WbemDefPath:IUnknown:Release (This=0x58726c0) returned 0x2 [0327.979] WbemDefPath:IWbemPath:SetText (This=0x58726c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1436\"") returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.979] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.979] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a8c4*=0, plFlavor=0x237a8c8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x59c, varVal2=0x0), pType=0x237a8c4*=19, plFlavor=0x237a8c8*=0) returned 0x0 [0327.980] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a8c4*=19, plFlavor=0x237a8c8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x59c, varVal2=0x0), pType=0x237a8c4*=19, plFlavor=0x237a8c8*=0) returned 0x0 [0327.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.980] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.980] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.980] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a9c8*=0, plFlavor=0x237a9cc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x237a9c8*=8, plFlavor=0x237a9cc*=0) returned 0x0 [0327.980] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.980] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.980] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237a9c8*=8, plFlavor=0x237a9cc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x237a9c8*=8, plFlavor=0x237a9cc*=0) returned 0x0 [0327.981] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.981] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.981] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0327.981] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0327.981] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0327.981] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237ab04*=0, plFlavor=0x237ab08*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x237ab04*=8, plFlavor=0x237ab08*=0) returned 0x0 [0327.981] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.981] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.982] IWbemClassObject:Get (in: This=0x58eb1e0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237ab04*=8, plFlavor=0x237ab08*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x237ab04*=8, plFlavor=0x237ab08*=0) returned 0x0 [0327.982] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.982] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0327.982] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0327.982] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x58ead18, puReturned=0x2377db0*=0x1) returned 0x0 [0328.022] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ead18) returned 0x0 [0328.022] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.022] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.022] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.023] IUnknown:AddRef (This=0x58ead18) returned 0x3 [0328.023] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.023] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.023] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ead1c) returned 0x0 [0328.023] IMarshal:GetUnmarshalClass (in: This=0x58ead1c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.023] IUnknown:Release (This=0x58ead1c) returned 0x3 [0328.023] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.023] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.023] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.024] IUnknown:Release (This=0x58ead18) returned 0x2 [0328.024] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.024] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.024] IUnknown:QueryInterface (in: This=0x58ead18, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ead18) returned 0x0 [0328.024] IUnknown:AddRef (This=0x58ead18) returned 0x4 [0328.024] IUnknown:Release (This=0x58ead18) returned 0x3 [0328.024] IUnknown:Release (This=0x58ead18) returned 0x2 [0328.024] CoTaskMemFree (pv=0x586b490) [0328.024] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.024] IUnknown:AddRef (This=0x58ead18) returned 0x3 [0328.024] IWbemClassObject:Get (in: This=0x58ead18, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.025] IWbemClassObject:Get (in: This=0x58ead18, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.025] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0328.025] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x5e [0328.025] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.026] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.026] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.027] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0328.027] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.028] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873140) returned 0x0 [0328.028] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0328.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873140) returned 0x0 [0328.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.028] WbemDefPath:IUnknown:AddRef (This=0x5873140) returned 0x3 [0328.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cbab0) returned 0x0 [0328.029] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cbab0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.029] WbemDefPath:IUnknown:Release (This=0x58cbab0) returned 0x3 [0328.029] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.029] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.029] WbemDefPath:IUnknown:Release (This=0x5873140) returned 0x2 [0328.029] WbemDefPath:IUnknown:Release (This=0x5873140) returned 0x1 [0328.029] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.030] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873140, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873140) returned 0x0 [0328.030] WbemDefPath:IUnknown:AddRef (This=0x5873140) returned 0x3 [0328.030] WbemDefPath:IUnknown:Release (This=0x5873140) returned 0x2 [0328.030] WbemDefPath:IWbemPath:SetText (This=0x5873140, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1524\"") returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.030] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.030] IWbemClassObject:Get (in: This=0x58ead18, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b464*=0, plFlavor=0x237b468*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x237b464*=19, plFlavor=0x237b468*=0) returned 0x0 [0328.031] IWbemClassObject:Get (in: This=0x58ead18, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b464*=19, plFlavor=0x237b468*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x237b464*=19, plFlavor=0x237b468*=0) returned 0x0 [0328.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.031] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.031] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.031] IWbemClassObject:Get (in: This=0x58ead18, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b568*=0, plFlavor=0x237b56c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x237b568*=8, plFlavor=0x237b56c*=0) returned 0x0 [0328.031] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0328.031] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0328.031] IWbemClassObject:Get (in: This=0x58ead18, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b568*=8, plFlavor=0x237b56c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x237b568*=8, plFlavor=0x237b56c*=0) returned 0x0 [0328.031] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0328.032] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0328.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.032] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.032] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.032] IWbemClassObject:Get (in: This=0x58ead18, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b6bc*=0, plFlavor=0x237b6c0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x237b6bc*=8, plFlavor=0x237b6c0*=0) returned 0x0 [0328.032] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0328.032] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0328.032] IWbemClassObject:Get (in: This=0x58ead18, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237b6bc*=8, plFlavor=0x237b6c0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", varVal2=0x0), pType=0x237b6bc*=8, plFlavor=0x237b6c0*=0) returned 0x0 [0328.032] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0328.032] SysStringByteLen (bstr="C:\\Windows\\System32\\RuntimeBroker.exe -Embedding") returned 0x60 [0328.033] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0328.033] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58ea388, puReturned=0x2377db0*=0x1) returned 0x0 [0328.035] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea388) returned 0x0 [0328.035] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.035] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.035] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.036] IUnknown:AddRef (This=0x58ea388) returned 0x3 [0328.036] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.036] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.036] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea38c) returned 0x0 [0328.036] IMarshal:GetUnmarshalClass (in: This=0x58ea38c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.036] IUnknown:Release (This=0x58ea38c) returned 0x3 [0328.036] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.036] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.036] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.037] IUnknown:Release (This=0x58ea388) returned 0x2 [0328.037] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.037] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.037] IUnknown:QueryInterface (in: This=0x58ea388, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea388) returned 0x0 [0328.037] IUnknown:AddRef (This=0x58ea388) returned 0x4 [0328.037] IUnknown:Release (This=0x58ea388) returned 0x3 [0328.037] IUnknown:Release (This=0x58ea388) returned 0x2 [0328.037] CoTaskMemFree (pv=0x586b460) [0328.037] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.037] IUnknown:AddRef (This=0x58ea388) returned 0x3 [0328.037] IWbemClassObject:Get (in: This=0x58ea388, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.037] IWbemClassObject:Get (in: This=0x58ea388, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.039] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0328.039] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x5e [0328.039] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.039] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.039] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.039] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.041] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0328.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.041] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58731b0) returned 0x0 [0328.041] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0328.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58731b0) returned 0x0 [0328.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.042] WbemDefPath:IUnknown:AddRef (This=0x58731b0) returned 0x3 [0328.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb900) returned 0x0 [0328.042] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.042] WbemDefPath:IUnknown:Release (This=0x58cb900) returned 0x3 [0328.042] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.042] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.043] WbemDefPath:IUnknown:Release (This=0x58731b0) returned 0x2 [0328.043] WbemDefPath:IUnknown:Release (This=0x58731b0) returned 0x1 [0328.043] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.043] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.043] WbemDefPath:IUnknown:QueryInterface (in: This=0x58731b0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58731b0) returned 0x0 [0328.043] WbemDefPath:IUnknown:AddRef (This=0x58731b0) returned 0x3 [0328.043] WbemDefPath:IUnknown:Release (This=0x58731b0) returned 0x2 [0328.043] WbemDefPath:IWbemPath:SetText (This=0x58731b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1496\"") returned 0x0 [0328.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.043] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.044] IWbemClassObject:Get (in: This=0x58ea388, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c13c*=0, plFlavor=0x237c140*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5d8, varVal2=0x0), pType=0x237c13c*=19, plFlavor=0x237c140*=0) returned 0x0 [0328.044] IWbemClassObject:Get (in: This=0x58ea388, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c13c*=19, plFlavor=0x237c140*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5d8, varVal2=0x0), pType=0x237c13c*=19, plFlavor=0x237c140*=0) returned 0x0 [0328.044] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.044] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.045] IWbemClassObject:Get (in: This=0x58ea388, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c240*=0, plFlavor=0x237c244*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x237c240*=8, plFlavor=0x237c244*=0) returned 0x0 [0328.045] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0328.045] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0328.045] IWbemClassObject:Get (in: This=0x58ea388, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c240*=8, plFlavor=0x237c244*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x237c240*=8, plFlavor=0x237c244*=0) returned 0x0 [0328.045] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0328.045] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0328.045] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.045] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.046] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.046] IWbemClassObject:Get (in: This=0x58ea388, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c384*=0, plFlavor=0x237c388*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x237c384*=8, plFlavor=0x237c388*=0) returned 0x0 [0328.046] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0328.046] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0328.046] IWbemClassObject:Get (in: This=0x58ea388, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237c384*=8, plFlavor=0x237c388*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}", varVal2=0x0), pType=0x237c384*=8, plFlavor=0x237c388*=0) returned 0x0 [0328.046] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0328.046] SysStringByteLen (bstr="taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}") returned 0x68 [0328.047] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0328.047] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58ea6b8, puReturned=0x2377db0*=0x1) returned 0x0 [0328.050] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea6b8) returned 0x0 [0328.050] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.051] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.051] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.051] IUnknown:AddRef (This=0x58ea6b8) returned 0x3 [0328.051] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.051] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.051] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea6bc) returned 0x0 [0328.051] IMarshal:GetUnmarshalClass (in: This=0x58ea6bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.051] IUnknown:Release (This=0x58ea6bc) returned 0x3 [0328.051] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.052] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.052] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.052] IUnknown:Release (This=0x58ea6b8) returned 0x2 [0328.052] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.052] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.052] IUnknown:QueryInterface (in: This=0x58ea6b8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea6b8) returned 0x0 [0328.052] IUnknown:AddRef (This=0x58ea6b8) returned 0x4 [0328.052] IUnknown:Release (This=0x58ea6b8) returned 0x3 [0328.052] IUnknown:Release (This=0x58ea6b8) returned 0x2 [0328.052] CoTaskMemFree (pv=0x586b340) [0328.052] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.053] IUnknown:AddRef (This=0x58ea6b8) returned 0x3 [0328.053] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.053] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.054] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0328.054] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x5e [0328.054] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.055] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.055] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.055] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.056] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0328.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.057] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872730) returned 0x0 [0328.057] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872730) returned 0x0 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.057] WbemDefPath:IUnknown:AddRef (This=0x5872730) returned 0x3 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cbdb0) returned 0x0 [0328.058] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cbdb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.058] WbemDefPath:IUnknown:Release (This=0x58cbdb0) returned 0x3 [0328.058] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.058] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.058] WbemDefPath:IUnknown:Release (This=0x5872730) returned 0x2 [0328.058] WbemDefPath:IUnknown:Release (This=0x5872730) returned 0x1 [0328.058] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.058] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872730, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872730) returned 0x0 [0328.059] WbemDefPath:IUnknown:AddRef (This=0x5872730) returned 0x3 [0328.059] WbemDefPath:IUnknown:Release (This=0x5872730) returned 0x2 [0328.059] WbemDefPath:IWbemPath:SetText (This=0x5872730, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1376\"") returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.059] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.059] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237cde8*=0, plFlavor=0x237cdec*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x560, varVal2=0x0), pType=0x237cde8*=19, plFlavor=0x237cdec*=0) returned 0x0 [0328.060] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237cde8*=19, plFlavor=0x237cdec*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x560, varVal2=0x0), pType=0x237cde8*=19, plFlavor=0x237cdec*=0) returned 0x0 [0328.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.060] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.060] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.060] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237ceec*=0, plFlavor=0x237cef0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x237ceec*=8, plFlavor=0x237cef0*=0) returned 0x0 [0328.060] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0328.060] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0328.060] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237ceec*=8, plFlavor=0x237cef0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x237ceec*=8, plFlavor=0x237cef0*=0) returned 0x0 [0328.061] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0328.061] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0328.061] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.061] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.061] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.061] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237d030*=0, plFlavor=0x237d034*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x237d030*=8, plFlavor=0x237d034*=0) returned 0x0 [0328.061] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0328.061] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0328.061] IWbemClassObject:Get (in: This=0x58ea6b8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237d030*=8, plFlavor=0x237d034*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\Explorer.EXE", varVal2=0x0), pType=0x237d030*=8, plFlavor=0x237d034*=0) returned 0x0 [0328.062] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0328.062] SysStringByteLen (bstr="C:\\Windows\\Explorer.EXE") returned 0x2e [0328.062] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0328.062] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58e9860, puReturned=0x2377db0*=0x1) returned 0x0 [0328.112] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e9860) returned 0x0 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.113] IUnknown:AddRef (This=0x58e9860) returned 0x3 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.113] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e9864) returned 0x0 [0328.114] IMarshal:GetUnmarshalClass (in: This=0x58e9864, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.114] IUnknown:Release (This=0x58e9864) returned 0x3 [0328.114] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.114] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.114] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.114] IUnknown:Release (This=0x58e9860) returned 0x2 [0328.114] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.114] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.114] IUnknown:QueryInterface (in: This=0x58e9860, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e9860) returned 0x0 [0328.114] IUnknown:AddRef (This=0x58e9860) returned 0x4 [0328.114] IUnknown:Release (This=0x58e9860) returned 0x3 [0328.114] IUnknown:Release (This=0x58e9860) returned 0x2 [0328.114] CoTaskMemFree (pv=0x586b460) [0328.114] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.115] IUnknown:AddRef (This=0x58e9860) returned 0x3 [0328.115] IWbemClassObject:Get (in: This=0x58e9860, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.115] IWbemClassObject:Get (in: This=0x58e9860, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.115] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0328.115] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x5e [0328.115] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.115] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.116] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.116] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.117] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0328.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.117] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872a40) returned 0x0 [0328.117] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872a40) returned 0x0 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.118] WbemDefPath:IUnknown:AddRef (This=0x5872a40) returned 0x3 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.118] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cbc00) returned 0x0 [0328.118] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cbc00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.119] WbemDefPath:IUnknown:Release (This=0x58cbc00) returned 0x3 [0328.119] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.119] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.119] WbemDefPath:IUnknown:Release (This=0x5872a40) returned 0x2 [0328.119] WbemDefPath:IUnknown:Release (This=0x5872a40) returned 0x1 [0328.119] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.119] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.119] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872a40, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872a40) returned 0x0 [0328.119] WbemDefPath:IUnknown:AddRef (This=0x5872a40) returned 0x3 [0328.119] WbemDefPath:IUnknown:Release (This=0x5872a40) returned 0x2 [0328.119] WbemDefPath:IWbemPath:SetText (This=0x5872a40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2388\"") returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.120] IWbemClassObject:Get (in: This=0x58e9860, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237d9e0*=0, plFlavor=0x237d9e4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x954, varVal2=0x0), pType=0x237d9e0*=19, plFlavor=0x237d9e4*=0) returned 0x0 [0328.120] IWbemClassObject:Get (in: This=0x58e9860, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237d9e0*=19, plFlavor=0x237d9e4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x954, varVal2=0x0), pType=0x237d9e0*=19, plFlavor=0x237d9e4*=0) returned 0x0 [0328.120] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.121] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.121] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.121] IWbemClassObject:Get (in: This=0x58e9860, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237dae4*=0, plFlavor=0x237dae8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x237dae4*=8, plFlavor=0x237dae8*=0) returned 0x0 [0328.121] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0328.121] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0328.121] IWbemClassObject:Get (in: This=0x58e9860, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237dae4*=8, plFlavor=0x237dae8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x237dae4*=8, plFlavor=0x237dae8*=0) returned 0x0 [0328.121] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0328.121] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0328.121] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.122] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.122] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.122] IWbemClassObject:Get (in: This=0x58e9860, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237dc50*=0, plFlavor=0x237dc54*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x237dc50*=8, plFlavor=0x237dc54*=0) returned 0x0 [0328.122] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0328.122] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0328.122] IWbemClassObject:Get (in: This=0x58e9860, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237dc50*=8, plFlavor=0x237dc54*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca", varVal2=0x0), pType=0x237dc50*=8, plFlavor=0x237dc54*=0) returned 0x0 [0328.122] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0328.122] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca") returned 0x114 [0328.123] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0328.123] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58e96c8, puReturned=0x2377db0*=0x1) returned 0x0 [0328.126] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e96c8) returned 0x0 [0328.126] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.126] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.126] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.127] IUnknown:AddRef (This=0x58e96c8) returned 0x3 [0328.127] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.127] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.127] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e96cc) returned 0x0 [0328.127] IMarshal:GetUnmarshalClass (in: This=0x58e96cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.127] IUnknown:Release (This=0x58e96cc) returned 0x3 [0328.128] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.128] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.128] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.128] IUnknown:Release (This=0x58e96c8) returned 0x2 [0328.128] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.128] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.128] IUnknown:QueryInterface (in: This=0x58e96c8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e96c8) returned 0x0 [0328.129] IUnknown:AddRef (This=0x58e96c8) returned 0x4 [0328.129] IUnknown:Release (This=0x58e96c8) returned 0x3 [0328.129] IUnknown:Release (This=0x58e96c8) returned 0x2 [0328.129] CoTaskMemFree (pv=0x586b2e0) [0328.129] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.129] IUnknown:AddRef (This=0x58e96c8) returned 0x3 [0328.129] IWbemClassObject:Get (in: This=0x58e96c8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.129] IWbemClassObject:Get (in: This=0x58e96c8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.129] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0328.130] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x5e [0328.130] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.130] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.130] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.130] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.132] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0328.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.132] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872420) returned 0x0 [0328.132] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0328.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872420) returned 0x0 [0328.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.133] WbemDefPath:IUnknown:AddRef (This=0x5872420) returned 0x3 [0328.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c82b8) returned 0x0 [0328.133] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c82b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.133] WbemDefPath:IUnknown:Release (This=0x58c82b8) returned 0x3 [0328.133] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.133] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.133] WbemDefPath:IUnknown:Release (This=0x5872420) returned 0x2 [0328.133] WbemDefPath:IUnknown:Release (This=0x5872420) returned 0x1 [0328.133] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.133] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872420, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872420) returned 0x0 [0328.134] WbemDefPath:IUnknown:AddRef (This=0x5872420) returned 0x3 [0328.134] WbemDefPath:IUnknown:Release (This=0x5872420) returned 0x2 [0328.134] WbemDefPath:IWbemPath:SetText (This=0x5872420, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2524\"") returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.134] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.134] IWbemClassObject:Get (in: This=0x58e96c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237e8cc*=0, plFlavor=0x237e8d0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9dc, varVal2=0x0), pType=0x237e8cc*=19, plFlavor=0x237e8d0*=0) returned 0x0 [0328.134] IWbemClassObject:Get (in: This=0x58e96c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237e8cc*=19, plFlavor=0x237e8d0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9dc, varVal2=0x0), pType=0x237e8cc*=19, plFlavor=0x237e8d0*=0) returned 0x0 [0328.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.135] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.135] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.135] IWbemClassObject:Get (in: This=0x58e96c8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237e9d0*=0, plFlavor=0x237e9d4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x237e9d0*=8, plFlavor=0x237e9d4*=0) returned 0x0 [0328.135] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0328.135] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0328.135] IWbemClassObject:Get (in: This=0x58e96c8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237e9d0*=8, plFlavor=0x237e9d4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x237e9d0*=8, plFlavor=0x237e9d4*=0) returned 0x0 [0328.135] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0328.135] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0328.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.135] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.135] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.136] IWbemClassObject:Get (in: This=0x58e96c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237eb14*=0, plFlavor=0x237eb18*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x237eb14*=8, plFlavor=0x237eb18*=0) returned 0x0 [0328.136] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0328.136] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0328.136] IWbemClassObject:Get (in: This=0x58e96c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237eb14*=8, plFlavor=0x237eb18*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca", varVal2=0x0), pType=0x237eb14*=8, plFlavor=0x237eb18*=0) returned 0x0 [0328.136] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0328.136] SysStringByteLen (bstr="\"C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe\" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca") returned 0x116 [0328.136] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0328.136] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58ea850, puReturned=0x2377db0*=0x1) returned 0x0 [0328.180] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea850) returned 0x0 [0328.181] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.181] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.181] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.181] IUnknown:AddRef (This=0x58ea850) returned 0x3 [0328.181] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.182] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.182] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea854) returned 0x0 [0328.182] IMarshal:GetUnmarshalClass (in: This=0x58ea854, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.182] IUnknown:Release (This=0x58ea854) returned 0x3 [0328.182] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.182] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.182] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.182] IUnknown:Release (This=0x58ea850) returned 0x2 [0328.182] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.183] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.183] IUnknown:QueryInterface (in: This=0x58ea850, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea850) returned 0x0 [0328.183] IUnknown:AddRef (This=0x58ea850) returned 0x4 [0328.183] IUnknown:Release (This=0x58ea850) returned 0x3 [0328.183] IUnknown:Release (This=0x58ea850) returned 0x2 [0328.183] CoTaskMemFree (pv=0x586b460) [0328.183] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.183] IUnknown:AddRef (This=0x58ea850) returned 0x3 [0328.183] IWbemClassObject:Get (in: This=0x58ea850, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.183] IWbemClassObject:Get (in: This=0x58ea850, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0328.184] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x5e [0328.184] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.184] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.184] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.184] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.186] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0328.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.186] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5872490) returned 0x0 [0328.186] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0328.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5872490) returned 0x0 [0328.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.186] WbemDefPath:IUnknown:AddRef (This=0x5872490) returned 0x3 [0328.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8210) returned 0x0 [0328.187] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8210, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.187] WbemDefPath:IUnknown:Release (This=0x58c8210) returned 0x3 [0328.187] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.187] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.187] WbemDefPath:IUnknown:Release (This=0x5872490) returned 0x2 [0328.187] WbemDefPath:IUnknown:Release (This=0x5872490) returned 0x1 [0328.187] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.187] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x5872490, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5872490) returned 0x0 [0328.187] WbemDefPath:IUnknown:AddRef (This=0x5872490) returned 0x3 [0328.188] WbemDefPath:IUnknown:Release (This=0x5872490) returned 0x2 [0328.188] WbemDefPath:IWbemPath:SetText (This=0x5872490, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2936\"") returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.188] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.188] IWbemClassObject:Get (in: This=0x58ea850, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237f7c8*=0, plFlavor=0x237f7cc*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb78, varVal2=0x0), pType=0x237f7c8*=19, plFlavor=0x237f7cc*=0) returned 0x0 [0328.189] IWbemClassObject:Get (in: This=0x58ea850, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237f7c8*=19, plFlavor=0x237f7cc*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb78, varVal2=0x0), pType=0x237f7c8*=19, plFlavor=0x237f7cc*=0) returned 0x0 [0328.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.189] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.189] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.189] IWbemClassObject:Get (in: This=0x58ea850, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237f8cc*=0, plFlavor=0x237f8d0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x237f8cc*=8, plFlavor=0x237f8d0*=0) returned 0x0 [0328.189] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0328.189] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0328.189] IWbemClassObject:Get (in: This=0x58ea850, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237f8cc*=8, plFlavor=0x237f8d0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x237f8cc*=8, plFlavor=0x237f8d0*=0) returned 0x0 [0328.190] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0328.190] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0328.191] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.191] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.191] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.191] IWbemClassObject:Get (in: This=0x58ea850, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237fa08*=0, plFlavor=0x237fa0c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x237fa08*=8, plFlavor=0x237fa0c*=0) returned 0x0 [0328.191] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0328.191] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0328.191] IWbemClassObject:Get (in: This=0x58ea850, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x237fa08*=8, plFlavor=0x237fa0c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup", varVal2=0x0), pType=0x237fa08*=8, plFlavor=0x237fa0c*=0) returned 0x0 [0328.192] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0328.192] SysStringByteLen (bstr="C:\\Windows\\system32\\svchost.exe -k UnistackSvcGroup") returned 0x66 [0328.192] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0328.192] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58e9b90, puReturned=0x2377db0*=0x1) returned 0x0 [0328.196] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e9b90) returned 0x0 [0328.196] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0328.196] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0328.196] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0328.197] IUnknown:AddRef (This=0x58e9b90) returned 0x3 [0328.197] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0328.197] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0328.197] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e9b94) returned 0x0 [0328.197] IMarshal:GetUnmarshalClass (in: This=0x58e9b94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0328.197] IUnknown:Release (This=0x58e9b94) returned 0x3 [0328.197] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0328.198] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0328.198] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0328.198] IUnknown:Release (This=0x58e9b90) returned 0x2 [0328.198] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0328.198] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0328.198] IUnknown:QueryInterface (in: This=0x58e9b90, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e9b90) returned 0x0 [0328.198] IUnknown:AddRef (This=0x58e9b90) returned 0x4 [0328.198] IUnknown:Release (This=0x58e9b90) returned 0x3 [0328.198] IUnknown:Release (This=0x58e9b90) returned 0x2 [0328.198] CoTaskMemFree (pv=0x586b460) [0328.198] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0328.198] IUnknown:AddRef (This=0x58e9b90) returned 0x3 [0328.198] IWbemClassObject:Get (in: This=0x58e9b90, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0328.199] IWbemClassObject:Get (in: This=0x58e9b90, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0328.199] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0328.199] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x5e [0328.199] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0328.199] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0328.199] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0328.199] IUnknown:Release (This=0x692bc4) returned 0x1 [0328.201] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0328.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0328.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873300) returned 0x0 [0328.201] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0328.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873300) returned 0x0 [0328.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0328.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0328.202] WbemDefPath:IUnknown:AddRef (This=0x5873300) returned 0x3 [0328.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0328.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0328.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8408) returned 0x0 [0328.202] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8408, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0328.202] WbemDefPath:IUnknown:Release (This=0x58c8408) returned 0x3 [0328.202] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0328.203] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0328.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0328.203] WbemDefPath:IUnknown:Release (This=0x5873300) returned 0x2 [0328.203] WbemDefPath:IUnknown:Release (This=0x5873300) returned 0x1 [0328.203] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0328.203] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0328.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873300, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873300) returned 0x0 [0328.203] WbemDefPath:IUnknown:AddRef (This=0x5873300) returned 0x3 [0328.203] WbemDefPath:IUnknown:Release (This=0x5873300) returned 0x2 [0328.204] WbemDefPath:IWbemPath:SetText (This=0x5873300, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2220\"") returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.204] IWbemClassObject:Get (in: This=0x58e9b90, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238045c*=0, plFlavor=0x2380460*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8ac, varVal2=0x0), pType=0x238045c*=19, plFlavor=0x2380460*=0) returned 0x0 [0328.204] IWbemClassObject:Get (in: This=0x58e9b90, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238045c*=19, plFlavor=0x2380460*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8ac, varVal2=0x0), pType=0x238045c*=19, plFlavor=0x2380460*=0) returned 0x0 [0328.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.205] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.205] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.205] IWbemClassObject:Get (in: This=0x58e9b90, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2380560*=0, plFlavor=0x2380564*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2380560*=8, plFlavor=0x2380564*=0) returned 0x0 [0328.205] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0328.206] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0328.206] IWbemClassObject:Get (in: This=0x58e9b90, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2380560*=8, plFlavor=0x2380564*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x2380560*=8, plFlavor=0x2380564*=0) returned 0x0 [0328.206] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0328.206] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0328.206] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0328.206] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0328.206] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0328.206] IWbemClassObject:Get (in: This=0x58e9b90, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23806a4*=0, plFlavor=0x23806a8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x23806a4*=8, plFlavor=0x23806a8*=0) returned 0x0 [0328.207] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0328.207] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0328.207] IWbemClassObject:Get (in: This=0x58e9b90, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23806a4*=8, plFlavor=0x23806a8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank", varVal2=0x0), pType=0x23806a4*=8, plFlavor=0x23806a8*=0) returned 0x0 [0328.207] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0328.207] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" about:blank") returned 0x7a [0328.207] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0328.207] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58ea520, puReturned=0x2377db0*=0x1) returned 0x0 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea520) returned 0x0 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.354] IUnknown:AddRef (This=0x58ea520) returned 0x3 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.354] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea524) returned 0x0 [0329.355] IMarshal:GetUnmarshalClass (in: This=0x58ea524, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.355] IUnknown:Release (This=0x58ea524) returned 0x3 [0329.355] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.355] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.355] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.355] IUnknown:Release (This=0x58ea520) returned 0x2 [0329.355] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.355] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.355] IUnknown:QueryInterface (in: This=0x58ea520, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea520) returned 0x0 [0329.355] IUnknown:AddRef (This=0x58ea520) returned 0x4 [0329.355] IUnknown:Release (This=0x58ea520) returned 0x3 [0329.355] IUnknown:Release (This=0x58ea520) returned 0x2 [0329.355] CoTaskMemFree (pv=0x586b2e0) [0329.355] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.355] IUnknown:AddRef (This=0x58ea520) returned 0x3 [0329.355] IWbemClassObject:Get (in: This=0x58ea520, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.356] IWbemClassObject:Get (in: This=0x58ea520, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.356] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0329.356] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x5e [0329.356] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.356] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.356] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.356] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.357] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.358] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873290) returned 0x0 [0329.358] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873290) returned 0x0 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.358] WbemDefPath:IUnknown:AddRef (This=0x5873290) returned 0x3 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c86d8) returned 0x0 [0329.358] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c86d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.358] WbemDefPath:IUnknown:Release (This=0x58c86d8) returned 0x3 [0329.358] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.359] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.359] WbemDefPath:IUnknown:Release (This=0x5873290) returned 0x2 [0329.359] WbemDefPath:IUnknown:Release (This=0x5873290) returned 0x1 [0329.359] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.359] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.359] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873290, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873290) returned 0x0 [0329.359] WbemDefPath:IUnknown:AddRef (This=0x5873290) returned 0x3 [0329.359] WbemDefPath:IUnknown:Release (This=0x5873290) returned 0x2 [0329.359] WbemDefPath:IWbemPath:SetText (This=0x5873290, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3340\"") returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.359] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.359] IWbemClassObject:Get (in: This=0x58ea520, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381138*=0, plFlavor=0x238113c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x2381138*=19, plFlavor=0x238113c*=0) returned 0x0 [0329.360] IWbemClassObject:Get (in: This=0x58ea520, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381138*=19, plFlavor=0x238113c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd0c, varVal2=0x0), pType=0x2381138*=19, plFlavor=0x238113c*=0) returned 0x0 [0329.360] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.360] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.360] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.360] IWbemClassObject:Get (in: This=0x58ea520, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238123c*=0, plFlavor=0x2381240*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x238123c*=8, plFlavor=0x2381240*=0) returned 0x0 [0329.360] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0329.360] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0329.360] IWbemClassObject:Get (in: This=0x58ea520, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238123c*=8, plFlavor=0x2381240*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fineperform.exe", varVal2=0x0), pType=0x238123c*=8, plFlavor=0x2381240*=0) returned 0x0 [0329.360] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0329.360] SysStringByteLen (bstr="fineperform.exe") returned 0x1e [0329.361] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.361] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.361] IWbemClassObject:Get (in: This=0x58ea520, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381388*=0, plFlavor=0x238138c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ", varVal2=0x0), pType=0x2381388*=8, plFlavor=0x238138c*=0) returned 0x0 [0329.361] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0329.361] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0329.361] IWbemClassObject:Get (in: This=0x58ea520, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381388*=8, plFlavor=0x238138c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ", varVal2=0x0), pType=0x2381388*=8, plFlavor=0x238138c*=0) returned 0x0 [0329.361] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0329.361] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\fineperform.exe\" ") returned 0x70 [0329.361] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0329.361] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58eab80, puReturned=0x2377db0*=0x1) returned 0x0 [0329.364] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eab80) returned 0x0 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.365] IUnknown:AddRef (This=0x58eab80) returned 0x3 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eab84) returned 0x0 [0329.365] IMarshal:GetUnmarshalClass (in: This=0x58eab84, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.365] IUnknown:Release (This=0x58eab84) returned 0x3 [0329.365] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.365] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.365] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.366] IUnknown:Release (This=0x58eab80) returned 0x2 [0329.366] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.366] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.366] IUnknown:QueryInterface (in: This=0x58eab80, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eab80) returned 0x0 [0329.366] IUnknown:AddRef (This=0x58eab80) returned 0x4 [0329.366] IUnknown:Release (This=0x58eab80) returned 0x3 [0329.366] IUnknown:Release (This=0x58eab80) returned 0x2 [0329.366] CoTaskMemFree (pv=0x586b340) [0329.366] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.366] IUnknown:AddRef (This=0x58eab80) returned 0x3 [0329.366] IWbemClassObject:Get (in: This=0x58eab80, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.366] IWbemClassObject:Get (in: This=0x58eab80, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.366] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0329.366] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x5e [0329.367] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.367] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.367] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.367] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.368] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.368] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873370) returned 0x0 [0329.368] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873370) returned 0x0 [0329.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.369] WbemDefPath:IUnknown:AddRef (This=0x5873370) returned 0x3 [0329.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8768) returned 0x0 [0329.369] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8768, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.369] WbemDefPath:IUnknown:Release (This=0x58c8768) returned 0x3 [0329.369] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.369] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.369] WbemDefPath:IUnknown:Release (This=0x5873370) returned 0x2 [0329.369] WbemDefPath:IUnknown:Release (This=0x5873370) returned 0x1 [0329.369] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.369] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873370, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873370) returned 0x0 [0329.369] WbemDefPath:IUnknown:AddRef (This=0x5873370) returned 0x3 [0329.369] WbemDefPath:IUnknown:Release (This=0x5873370) returned 0x2 [0329.369] WbemDefPath:IWbemPath:SetText (This=0x5873370, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3348\"") returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.370] IWbemClassObject:Get (in: This=0x58eab80, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381e08*=0, plFlavor=0x2381e0c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd14, varVal2=0x0), pType=0x2381e08*=19, plFlavor=0x2381e0c*=0) returned 0x0 [0329.370] IWbemClassObject:Get (in: This=0x58eab80, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381e08*=19, plFlavor=0x2381e0c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd14, varVal2=0x0), pType=0x2381e08*=19, plFlavor=0x2381e0c*=0) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.370] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.370] IWbemClassObject:Get (in: This=0x58eab80, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381f0c*=0, plFlavor=0x2381f10*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2381f0c*=8, plFlavor=0x2381f10*=0) returned 0x0 [0329.370] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0329.371] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0329.371] IWbemClassObject:Get (in: This=0x58eab80, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381f0c*=8, plFlavor=0x2381f10*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="cause_begin_until.exe", varVal2=0x0), pType=0x2381f0c*=8, plFlavor=0x2381f10*=0) returned 0x0 [0329.371] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0329.371] SysStringByteLen (bstr="cause_begin_until.exe") returned 0x2a [0329.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.371] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.371] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.371] IWbemClassObject:Get (in: This=0x58eab80, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382070*=0, plFlavor=0x2382074*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ", varVal2=0x0), pType=0x2382070*=8, plFlavor=0x2382074*=0) returned 0x0 [0329.371] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0329.371] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0329.371] IWbemClassObject:Get (in: This=0x58eab80, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382070*=8, plFlavor=0x2382074*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ", varVal2=0x0), pType=0x2382070*=8, plFlavor=0x2382074*=0) returned 0x0 [0329.372] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0329.372] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Multimedia Platform\\cause_begin_until.exe\" ") returned 0x8a [0329.372] CoTaskMemAlloc (cb=0x4) returned 0x586b360 [0329.372] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b360, puReturned=0x2377db0 | out: apObjects=0x586b360*=0x58eb378, puReturned=0x2377db0*=0x1) returned 0x0 [0329.373] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eb378) returned 0x0 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.374] IUnknown:AddRef (This=0x58eb378) returned 0x3 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.374] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eb37c) returned 0x0 [0329.374] IMarshal:GetUnmarshalClass (in: This=0x58eb37c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.374] IUnknown:Release (This=0x58eb37c) returned 0x3 [0329.375] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.375] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.375] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.375] IUnknown:Release (This=0x58eb378) returned 0x2 [0329.375] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.375] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.375] IUnknown:QueryInterface (in: This=0x58eb378, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eb378) returned 0x0 [0329.375] IUnknown:AddRef (This=0x58eb378) returned 0x4 [0329.375] IUnknown:Release (This=0x58eb378) returned 0x3 [0329.375] IUnknown:Release (This=0x58eb378) returned 0x2 [0329.375] CoTaskMemFree (pv=0x586b360) [0329.375] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.375] IUnknown:AddRef (This=0x58eb378) returned 0x3 [0329.375] IWbemClassObject:Get (in: This=0x58eb378, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.376] IWbemClassObject:Get (in: This=0x58eb378, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.376] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0329.376] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x5e [0329.376] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.376] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.376] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.376] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.378] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b360) returned 0x0 [0329.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.378] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5873220) returned 0x0 [0329.378] WbemDefPath:IUnknown:Release (This=0x586b360) returned 0x0 [0329.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5873220) returned 0x0 [0329.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.378] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.378] WbemDefPath:IUnknown:AddRef (This=0x5873220) returned 0x3 [0329.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.379] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8a08) returned 0x0 [0329.379] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8a08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.379] WbemDefPath:IUnknown:Release (This=0x58c8a08) returned 0x3 [0329.379] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.379] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.380] WbemDefPath:IUnknown:Release (This=0x5873220) returned 0x2 [0329.380] WbemDefPath:IUnknown:Release (This=0x5873220) returned 0x1 [0329.380] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.380] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.380] WbemDefPath:IUnknown:QueryInterface (in: This=0x5873220, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5873220) returned 0x0 [0329.380] WbemDefPath:IUnknown:AddRef (This=0x5873220) returned 0x3 [0329.380] WbemDefPath:IUnknown:Release (This=0x5873220) returned 0x2 [0329.381] WbemDefPath:IWbemPath:SetText (This=0x5873220, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3360\"") returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.381] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.381] IWbemClassObject:Get (in: This=0x58eb378, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382b44*=0, plFlavor=0x2382b48*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd20, varVal2=0x0), pType=0x2382b44*=19, plFlavor=0x2382b48*=0) returned 0x0 [0329.382] IWbemClassObject:Get (in: This=0x58eb378, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382b44*=19, plFlavor=0x2382b48*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd20, varVal2=0x0), pType=0x2382b44*=19, plFlavor=0x2382b48*=0) returned 0x0 [0329.382] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.382] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.382] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.382] IWbemClassObject:Get (in: This=0x58eb378, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382c48*=0, plFlavor=0x2382c4c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x2382c48*=8, plFlavor=0x2382c4c*=0) returned 0x0 [0329.383] SysStringByteLen (bstr="speak.exe") returned 0x12 [0329.383] SysStringByteLen (bstr="speak.exe") returned 0x12 [0329.383] IWbemClassObject:Get (in: This=0x58eb378, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382c48*=8, plFlavor=0x2382c4c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="speak.exe", varVal2=0x0), pType=0x2382c48*=8, plFlavor=0x2382c4c*=0) returned 0x0 [0329.383] SysStringByteLen (bstr="speak.exe") returned 0x12 [0329.383] SysStringByteLen (bstr="speak.exe") returned 0x12 [0329.383] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.383] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.384] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.384] IWbemClassObject:Get (in: This=0x58eb378, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382d7c*=0, plFlavor=0x2382d80*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\speak.exe\" ", varVal2=0x0), pType=0x2382d7c*=8, plFlavor=0x2382d80*=0) returned 0x0 [0329.384] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0329.384] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0329.384] IWbemClassObject:Get (in: This=0x58eb378, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2382d7c*=8, plFlavor=0x2382d80*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\speak.exe\" ", varVal2=0x0), pType=0x2382d7c*=8, plFlavor=0x2382d80*=0) returned 0x0 [0329.384] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0329.385] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\speak.exe\" ") returned 0x54 [0329.385] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0329.385] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58ea058, puReturned=0x2377db0*=0x1) returned 0x0 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea058) returned 0x0 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.426] IUnknown:AddRef (This=0x58ea058) returned 0x3 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.426] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea05c) returned 0x0 [0329.427] IMarshal:GetUnmarshalClass (in: This=0x58ea05c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.427] IUnknown:Release (This=0x58ea05c) returned 0x3 [0329.427] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.427] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.427] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.427] IUnknown:Release (This=0x58ea058) returned 0x2 [0329.427] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.427] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.427] IUnknown:QueryInterface (in: This=0x58ea058, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea058) returned 0x0 [0329.427] IUnknown:AddRef (This=0x58ea058) returned 0x4 [0329.427] IUnknown:Release (This=0x58ea058) returned 0x3 [0329.427] IUnknown:Release (This=0x58ea058) returned 0x2 [0329.427] CoTaskMemFree (pv=0x586b2e0) [0329.428] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.428] IUnknown:AddRef (This=0x58ea058) returned 0x3 [0329.428] IWbemClassObject:Get (in: This=0x58ea058, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.428] IWbemClassObject:Get (in: This=0x58ea058, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.428] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0329.428] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x5e [0329.428] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.428] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.429] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.429] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.430] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b360) returned 0x0 [0329.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.430] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1a70) returned 0x0 [0329.431] WbemDefPath:IUnknown:Release (This=0x586b360) returned 0x0 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1a70) returned 0x0 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.431] WbemDefPath:IUnknown:AddRef (This=0x58f1a70) returned 0x3 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8978) returned 0x0 [0329.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8978, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.432] WbemDefPath:IUnknown:Release (This=0x58c8978) returned 0x3 [0329.432] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.432] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.432] WbemDefPath:IUnknown:Release (This=0x58f1a70) returned 0x2 [0329.432] WbemDefPath:IUnknown:Release (This=0x58f1a70) returned 0x1 [0329.432] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.432] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a70, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1a70) returned 0x0 [0329.432] WbemDefPath:IUnknown:AddRef (This=0x58f1a70) returned 0x3 [0329.432] WbemDefPath:IUnknown:Release (This=0x58f1a70) returned 0x2 [0329.432] WbemDefPath:IWbemPath:SetText (This=0x58f1a70, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3372\"") returned 0x0 [0329.432] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.432] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.433] IWbemClassObject:Get (in: This=0x58ea058, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238379c*=0, plFlavor=0x23837a0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd2c, varVal2=0x0), pType=0x238379c*=19, plFlavor=0x23837a0*=0) returned 0x0 [0329.433] IWbemClassObject:Get (in: This=0x58ea058, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238379c*=19, plFlavor=0x23837a0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd2c, varVal2=0x0), pType=0x238379c*=19, plFlavor=0x23837a0*=0) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.433] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.433] IWbemClassObject:Get (in: This=0x58ea058, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23838a0*=0, plFlavor=0x23838a4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x23838a0*=8, plFlavor=0x23838a4*=0) returned 0x0 [0329.433] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0329.433] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0329.434] IWbemClassObject:Get (in: This=0x58ea058, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23838a0*=8, plFlavor=0x23838a4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="recently-include-conference.exe", varVal2=0x0), pType=0x23838a0*=8, plFlavor=0x23838a4*=0) returned 0x0 [0329.434] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0329.434] SysStringByteLen (bstr="recently-include-conference.exe") returned 0x3e [0329.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.434] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.434] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.434] IWbemClassObject:Get (in: This=0x58ea058, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2383a2c*=0, plFlavor=0x2383a30*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ", varVal2=0x0), pType=0x2383a2c*=8, plFlavor=0x2383a30*=0) returned 0x0 [0329.434] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0329.434] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0329.434] IWbemClassObject:Get (in: This=0x58ea058, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2383a2c*=8, plFlavor=0x2383a30*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ", varVal2=0x0), pType=0x2383a2c*=8, plFlavor=0x2383a30*=0) returned 0x0 [0329.434] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0329.434] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\recently-include-conference.exe\" ") returned 0x9c [0329.435] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0329.435] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58eaeb0, puReturned=0x2377db0*=0x1) returned 0x0 [0329.437] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eaeb0) returned 0x0 [0329.437] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.437] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.437] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.438] IUnknown:AddRef (This=0x58eaeb0) returned 0x3 [0329.438] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.438] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.438] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eaeb4) returned 0x0 [0329.438] IMarshal:GetUnmarshalClass (in: This=0x58eaeb4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.438] IUnknown:Release (This=0x58eaeb4) returned 0x3 [0329.438] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.438] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.438] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.438] IUnknown:Release (This=0x58eaeb0) returned 0x2 [0329.438] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.438] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.438] IUnknown:QueryInterface (in: This=0x58eaeb0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eaeb0) returned 0x0 [0329.439] IUnknown:AddRef (This=0x58eaeb0) returned 0x4 [0329.439] IUnknown:Release (This=0x58eaeb0) returned 0x3 [0329.439] IUnknown:Release (This=0x58eaeb0) returned 0x2 [0329.439] CoTaskMemFree (pv=0x586b460) [0329.439] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.439] IUnknown:AddRef (This=0x58eaeb0) returned 0x3 [0329.439] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.439] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.439] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0329.439] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x5e [0329.439] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.440] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.440] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.440] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.441] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0329.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.441] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1c30) returned 0x0 [0329.441] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0329.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1c30) returned 0x0 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.442] WbemDefPath:IUnknown:AddRef (This=0x58f1c30) returned 0x3 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8ca8) returned 0x0 [0329.442] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8ca8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.442] WbemDefPath:IUnknown:Release (This=0x58c8ca8) returned 0x3 [0329.442] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.442] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.443] WbemDefPath:IUnknown:Release (This=0x58f1c30) returned 0x2 [0329.443] WbemDefPath:IUnknown:Release (This=0x58f1c30) returned 0x1 [0329.443] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.443] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1c30, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1c30) returned 0x0 [0329.443] WbemDefPath:IUnknown:AddRef (This=0x58f1c30) returned 0x3 [0329.443] WbemDefPath:IUnknown:Release (This=0x58f1c30) returned 0x2 [0329.443] WbemDefPath:IWbemPath:SetText (This=0x58f1c30, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3396\"") returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.444] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2384550*=0, plFlavor=0x2384554*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd44, varVal2=0x0), pType=0x2384550*=19, plFlavor=0x2384554*=0) returned 0x0 [0329.444] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2384550*=19, plFlavor=0x2384554*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd44, varVal2=0x0), pType=0x2384550*=19, plFlavor=0x2384554*=0) returned 0x0 [0329.444] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.444] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.444] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.444] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2384654*=0, plFlavor=0x2384658*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x2384654*=8, plFlavor=0x2384658*=0) returned 0x0 [0329.444] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0329.444] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0329.445] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2384654*=8, plFlavor=0x2384658*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bill_difficult_his.exe", varVal2=0x0), pType=0x2384654*=8, plFlavor=0x2384658*=0) returned 0x0 [0329.445] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0329.445] SysStringByteLen (bstr="bill_difficult_his.exe") returned 0x2c [0329.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.445] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.445] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.445] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23847c0*=0, plFlavor=0x23847c4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ", varVal2=0x0), pType=0x23847c0*=8, plFlavor=0x23847c4*=0) returned 0x0 [0329.445] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0329.445] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0329.445] IWbemClassObject:Get (in: This=0x58eaeb0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23847c0*=8, plFlavor=0x23847c4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ", varVal2=0x0), pType=0x23847c0*=8, plFlavor=0x23847c4*=0) returned 0x0 [0329.445] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0329.446] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft.NET\\bill_difficult_his.exe\" ") returned 0x70 [0329.446] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0329.446] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58eb510, puReturned=0x2377db0*=0x1) returned 0x0 [0329.450] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eb510) returned 0x0 [0329.450] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.450] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.450] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.451] IUnknown:AddRef (This=0x58eb510) returned 0x3 [0329.451] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.451] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.451] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eb514) returned 0x0 [0329.451] IMarshal:GetUnmarshalClass (in: This=0x58eb514, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.451] IUnknown:Release (This=0x58eb514) returned 0x3 [0329.451] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.451] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.451] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.451] IUnknown:Release (This=0x58eb510) returned 0x2 [0329.451] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.451] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.451] IUnknown:QueryInterface (in: This=0x58eb510, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eb510) returned 0x0 [0329.452] IUnknown:AddRef (This=0x58eb510) returned 0x4 [0329.452] IUnknown:Release (This=0x58eb510) returned 0x3 [0329.452] IUnknown:Release (This=0x58eb510) returned 0x2 [0329.452] CoTaskMemFree (pv=0x586b460) [0329.452] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.452] IUnknown:AddRef (This=0x58eb510) returned 0x3 [0329.452] IWbemClassObject:Get (in: This=0x58eb510, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.452] IWbemClassObject:Get (in: This=0x58eb510, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.452] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0329.452] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x5e [0329.452] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.453] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.453] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.453] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.454] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b380) returned 0x0 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b380, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.454] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b380, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2100) returned 0x0 [0329.454] WbemDefPath:IUnknown:Release (This=0x586b380) returned 0x0 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2100) returned 0x0 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.454] WbemDefPath:IUnknown:AddRef (This=0x58f2100) returned 0x3 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8e40) returned 0x0 [0329.455] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8e40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.455] WbemDefPath:IUnknown:Release (This=0x58c8e40) returned 0x3 [0329.455] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.455] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.455] WbemDefPath:IUnknown:Release (This=0x58f2100) returned 0x2 [0329.455] WbemDefPath:IUnknown:Release (This=0x58f2100) returned 0x1 [0329.455] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.455] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2100, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2100) returned 0x0 [0329.455] WbemDefPath:IUnknown:AddRef (This=0x58f2100) returned 0x3 [0329.455] WbemDefPath:IUnknown:Release (This=0x58f2100) returned 0x2 [0329.455] WbemDefPath:IWbemPath:SetText (This=0x58f2100, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3404\"") returned 0x0 [0329.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.455] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.503] IWbemClassObject:Get (in: This=0x58eb510, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238524c*=0, plFlavor=0x2385250*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd4c, varVal2=0x0), pType=0x238524c*=19, plFlavor=0x2385250*=0) returned 0x0 [0329.503] IWbemClassObject:Get (in: This=0x58eb510, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238524c*=19, plFlavor=0x2385250*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd4c, varVal2=0x0), pType=0x238524c*=19, plFlavor=0x2385250*=0) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.503] IWbemClassObject:Get (in: This=0x58eb510, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385350*=0, plFlavor=0x2385354*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x2385350*=8, plFlavor=0x2385354*=0) returned 0x0 [0329.503] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0329.503] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0329.504] IWbemClassObject:Get (in: This=0x58eb510, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385350*=8, plFlavor=0x2385354*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="marriage.exe", varVal2=0x0), pType=0x2385350*=8, plFlavor=0x2385354*=0) returned 0x0 [0329.504] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0329.504] SysStringByteLen (bstr="marriage.exe") returned 0x18 [0329.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.504] IWbemClassObject:Get (in: This=0x58eb510, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385494*=0, plFlavor=0x2385498*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ", varVal2=0x0), pType=0x2385494*=8, plFlavor=0x2385498*=0) returned 0x0 [0329.504] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0329.504] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0329.504] IWbemClassObject:Get (in: This=0x58eb510, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385494*=8, plFlavor=0x2385498*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ", varVal2=0x0), pType=0x2385494*=8, plFlavor=0x2385498*=0) returned 0x0 [0329.504] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0329.504] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\marriage.exe\" ") returned 0x64 [0329.505] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0329.505] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58e99f8, puReturned=0x2377db0*=0x1) returned 0x0 [0329.507] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e99f8) returned 0x0 [0329.507] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.507] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.507] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.507] IUnknown:AddRef (This=0x58e99f8) returned 0x3 [0329.508] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.508] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.508] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e99fc) returned 0x0 [0329.508] IMarshal:GetUnmarshalClass (in: This=0x58e99fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.508] IUnknown:Release (This=0x58e99fc) returned 0x3 [0329.508] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.508] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.508] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.508] IUnknown:Release (This=0x58e99f8) returned 0x2 [0329.508] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.508] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.508] IUnknown:QueryInterface (in: This=0x58e99f8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e99f8) returned 0x0 [0329.508] IUnknown:AddRef (This=0x58e99f8) returned 0x4 [0329.508] IUnknown:Release (This=0x58e99f8) returned 0x3 [0329.508] IUnknown:Release (This=0x58e99f8) returned 0x2 [0329.509] CoTaskMemFree (pv=0x586b340) [0329.509] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.509] IUnknown:AddRef (This=0x58e99f8) returned 0x3 [0329.509] IWbemClassObject:Get (in: This=0x58e99f8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.509] IWbemClassObject:Get (in: This=0x58e99f8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.509] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0329.509] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x5e [0329.509] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.509] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.509] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.509] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.510] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.511] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f16f0) returned 0x0 [0329.511] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f16f0) returned 0x0 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.511] WbemDefPath:IUnknown:AddRef (This=0x58f16f0) returned 0x3 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c91e8) returned 0x0 [0329.511] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c91e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.511] WbemDefPath:IUnknown:Release (This=0x58c91e8) returned 0x3 [0329.512] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.512] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.512] WbemDefPath:IUnknown:Release (This=0x58f16f0) returned 0x2 [0329.512] WbemDefPath:IUnknown:Release (This=0x58f16f0) returned 0x1 [0329.512] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.512] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f16f0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f16f0) returned 0x0 [0329.512] WbemDefPath:IUnknown:AddRef (This=0x58f16f0) returned 0x3 [0329.512] WbemDefPath:IUnknown:Release (This=0x58f16f0) returned 0x2 [0329.512] WbemDefPath:IWbemPath:SetText (This=0x58f16f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3420\"") returned 0x0 [0329.512] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.512] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.512] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.513] IWbemClassObject:Get (in: This=0x58e99f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385f74*=0, plFlavor=0x2385f78*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd5c, varVal2=0x0), pType=0x2385f74*=19, plFlavor=0x2385f78*=0) returned 0x0 [0329.513] IWbemClassObject:Get (in: This=0x58e99f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2385f74*=19, plFlavor=0x2385f78*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd5c, varVal2=0x0), pType=0x2385f74*=19, plFlavor=0x2385f78*=0) returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.513] IWbemClassObject:Get (in: This=0x58e99f8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386078*=0, plFlavor=0x238607c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x2386078*=8, plFlavor=0x238607c*=0) returned 0x0 [0329.513] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0329.514] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0329.514] IWbemClassObject:Get (in: This=0x58e99f8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386078*=8, plFlavor=0x238607c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="produceparent.exe", varVal2=0x0), pType=0x2386078*=8, plFlavor=0x238607c*=0) returned 0x0 [0329.514] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0329.514] SysStringByteLen (bstr="produceparent.exe") returned 0x22 [0329.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.514] IWbemClassObject:Get (in: This=0x58e99f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23861cc*=0, plFlavor=0x23861d0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ", varVal2=0x0), pType=0x23861cc*=8, plFlavor=0x23861d0*=0) returned 0x0 [0329.514] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0329.514] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0329.514] IWbemClassObject:Get (in: This=0x58e99f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23861cc*=8, plFlavor=0x23861d0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ", varVal2=0x0), pType=0x23861cc*=8, plFlavor=0x23861d0*=0) returned 0x0 [0329.515] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0329.515] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\produceparent.exe\" ") returned 0x5a [0329.515] CoTaskMemAlloc (cb=0x4) returned 0x586b380 [0329.515] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b380, puReturned=0x2377db0 | out: apObjects=0x586b380*=0x58ea9e8, puReturned=0x2377db0*=0x1) returned 0x0 [0329.517] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58ea9e8) returned 0x0 [0329.517] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.517] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.517] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.518] IUnknown:AddRef (This=0x58ea9e8) returned 0x3 [0329.518] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.518] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.518] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58ea9ec) returned 0x0 [0329.518] IMarshal:GetUnmarshalClass (in: This=0x58ea9ec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.518] IUnknown:Release (This=0x58ea9ec) returned 0x3 [0329.518] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.519] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.519] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.519] IUnknown:Release (This=0x58ea9e8) returned 0x2 [0329.519] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.519] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.519] IUnknown:QueryInterface (in: This=0x58ea9e8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58ea9e8) returned 0x0 [0329.519] IUnknown:AddRef (This=0x58ea9e8) returned 0x4 [0329.519] IUnknown:Release (This=0x58ea9e8) returned 0x3 [0329.519] IUnknown:Release (This=0x58ea9e8) returned 0x2 [0329.519] CoTaskMemFree (pv=0x586b380) [0329.519] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.519] IUnknown:AddRef (This=0x58ea9e8) returned 0x3 [0329.519] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.519] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.519] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0329.520] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x5e [0329.520] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.520] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.520] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.520] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.521] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b380) returned 0x0 [0329.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b380, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.521] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b380, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1a00) returned 0x0 [0329.521] WbemDefPath:IUnknown:Release (This=0x586b380) returned 0x0 [0329.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1a00) returned 0x0 [0329.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.522] WbemDefPath:IUnknown:AddRef (This=0x58f1a00) returned 0x3 [0329.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c8f00) returned 0x0 [0329.522] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c8f00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.522] WbemDefPath:IUnknown:Release (This=0x58c8f00) returned 0x3 [0329.522] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.522] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.522] WbemDefPath:IUnknown:Release (This=0x58f1a00) returned 0x2 [0329.522] WbemDefPath:IUnknown:Release (This=0x58f1a00) returned 0x1 [0329.522] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.522] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1a00, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1a00) returned 0x0 [0329.522] WbemDefPath:IUnknown:AddRef (This=0x58f1a00) returned 0x3 [0329.522] WbemDefPath:IUnknown:Release (This=0x58f1a00) returned 0x2 [0329.522] WbemDefPath:IWbemPath:SetText (This=0x58f1a00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3428\"") returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.523] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386c08*=0, plFlavor=0x2386c0c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd64, varVal2=0x0), pType=0x2386c08*=19, plFlavor=0x2386c0c*=0) returned 0x0 [0329.523] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386c08*=19, plFlavor=0x2386c0c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd64, varVal2=0x0), pType=0x2386c08*=19, plFlavor=0x2386c0c*=0) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.523] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.523] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386d0c*=0, plFlavor=0x2386d10*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x2386d0c*=8, plFlavor=0x2386d10*=0) returned 0x0 [0329.523] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0329.523] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0329.524] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386d0c*=8, plFlavor=0x2386d10*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="withprofessionalhe.exe", varVal2=0x0), pType=0x2386d0c*=8, plFlavor=0x2386d10*=0) returned 0x0 [0329.524] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0329.524] SysStringByteLen (bstr="withprofessionalhe.exe") returned 0x2c [0329.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.524] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.524] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.524] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386e78*=0, plFlavor=0x2386e7c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ", varVal2=0x0), pType=0x2386e78*=8, plFlavor=0x2386e7c*=0) returned 0x0 [0329.524] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0329.524] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0329.524] IWbemClassObject:Get (in: This=0x58ea9e8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2386e78*=8, plFlavor=0x2386e7c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ", varVal2=0x0), pType=0x2386e78*=8, plFlavor=0x2386e7c*=0) returned 0x0 [0329.524] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0329.524] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Common Files\\withprofessionalhe.exe\" ") returned 0x7a [0329.525] CoTaskMemAlloc (cb=0x4) returned 0x586b380 [0329.525] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b380, puReturned=0x2377db0 | out: apObjects=0x586b380*=0x58e9d28, puReturned=0x2377db0*=0x1) returned 0x0 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e9d28) returned 0x0 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.527] IUnknown:AddRef (This=0x58e9d28) returned 0x3 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.527] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e9d2c) returned 0x0 [0329.527] IMarshal:GetUnmarshalClass (in: This=0x58e9d2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.527] IUnknown:Release (This=0x58e9d2c) returned 0x3 [0329.528] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.528] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.528] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.528] IUnknown:Release (This=0x58e9d28) returned 0x2 [0329.528] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.528] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.528] IUnknown:QueryInterface (in: This=0x58e9d28, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e9d28) returned 0x0 [0329.528] IUnknown:AddRef (This=0x58e9d28) returned 0x4 [0329.528] IUnknown:Release (This=0x58e9d28) returned 0x3 [0329.528] IUnknown:Release (This=0x58e9d28) returned 0x2 [0329.528] CoTaskMemFree (pv=0x586b380) [0329.528] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.528] IUnknown:AddRef (This=0x58e9d28) returned 0x3 [0329.528] IWbemClassObject:Get (in: This=0x58e9d28, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.528] IWbemClassObject:Get (in: This=0x58e9d28, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.528] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0329.529] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x5e [0329.529] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.529] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.529] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.529] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.530] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b380) returned 0x0 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b380, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.530] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b380, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2170) returned 0x0 [0329.530] WbemDefPath:IUnknown:Release (This=0x586b380) returned 0x0 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2170) returned 0x0 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.530] WbemDefPath:IUnknown:AddRef (This=0x58f2170) returned 0x3 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c93b0) returned 0x0 [0329.531] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c93b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.531] WbemDefPath:IUnknown:Release (This=0x58c93b0) returned 0x3 [0329.531] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.531] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.531] WbemDefPath:IUnknown:Release (This=0x58f2170) returned 0x2 [0329.531] WbemDefPath:IUnknown:Release (This=0x58f2170) returned 0x1 [0329.531] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.531] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2170, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2170) returned 0x0 [0329.531] WbemDefPath:IUnknown:AddRef (This=0x58f2170) returned 0x3 [0329.531] WbemDefPath:IUnknown:Release (This=0x58f2170) returned 0x2 [0329.531] WbemDefPath:IWbemPath:SetText (This=0x58f2170, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3444\"") returned 0x0 [0329.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.531] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.531] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.531] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.532] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.532] IWbemClassObject:Get (in: This=0x58e9d28, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387920*=0, plFlavor=0x2387924*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd74, varVal2=0x0), pType=0x2387920*=19, plFlavor=0x2387924*=0) returned 0x0 [0329.532] IWbemClassObject:Get (in: This=0x58e9d28, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387920*=19, plFlavor=0x2387924*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd74, varVal2=0x0), pType=0x2387920*=19, plFlavor=0x2387924*=0) returned 0x0 [0329.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.532] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.532] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.532] IWbemClassObject:Get (in: This=0x58e9d28, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387a24*=0, plFlavor=0x2387a28*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x2387a24*=8, plFlavor=0x2387a28*=0) returned 0x0 [0329.532] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0329.532] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0329.532] IWbemClassObject:Get (in: This=0x58e9d28, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387a24*=8, plFlavor=0x2387a28*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explain room little.exe", varVal2=0x0), pType=0x2387a24*=8, plFlavor=0x2387a28*=0) returned 0x0 [0329.532] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0329.532] SysStringByteLen (bstr="explain room little.exe") returned 0x2e [0329.533] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.533] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.533] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.533] IWbemClassObject:Get (in: This=0x58e9d28, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387b90*=0, plFlavor=0x2387b94*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ", varVal2=0x0), pType=0x2387b90*=8, plFlavor=0x2387b94*=0) returned 0x0 [0329.533] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0329.533] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0329.533] IWbemClassObject:Get (in: This=0x58e9d28, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2387b90*=8, plFlavor=0x2387b94*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ", varVal2=0x0), pType=0x2387b90*=8, plFlavor=0x2387b94*=0) returned 0x0 [0329.533] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0329.533] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\explain room little.exe\" ") returned 0x9a [0329.533] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0329.533] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58eb048, puReturned=0x2377db0*=0x1) returned 0x0 [0329.598] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58eb048) returned 0x0 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.599] IUnknown:AddRef (This=0x58eb048) returned 0x3 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.599] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58eb04c) returned 0x0 [0329.599] IMarshal:GetUnmarshalClass (in: This=0x58eb04c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.599] IUnknown:Release (This=0x58eb04c) returned 0x3 [0329.599] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.600] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.600] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.600] IUnknown:Release (This=0x58eb048) returned 0x2 [0329.600] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.600] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.600] IUnknown:QueryInterface (in: This=0x58eb048, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58eb048) returned 0x0 [0329.600] IUnknown:AddRef (This=0x58eb048) returned 0x4 [0329.600] IUnknown:Release (This=0x58eb048) returned 0x3 [0329.600] IUnknown:Release (This=0x58eb048) returned 0x2 [0329.600] CoTaskMemFree (pv=0x586b340) [0329.600] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.600] IUnknown:AddRef (This=0x58eb048) returned 0x3 [0329.600] IWbemClassObject:Get (in: This=0x58eb048, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.601] IWbemClassObject:Get (in: This=0x58eb048, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.601] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0329.601] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x5e [0329.601] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.601] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.601] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.601] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.602] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0329.602] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.602] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2250) returned 0x0 [0329.602] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2250) returned 0x0 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.603] WbemDefPath:IUnknown:AddRef (This=0x58f2250) returned 0x3 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c9560) returned 0x0 [0329.603] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c9560, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.603] WbemDefPath:IUnknown:Release (This=0x58c9560) returned 0x3 [0329.603] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.603] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.604] WbemDefPath:IUnknown:Release (This=0x58f2250) returned 0x2 [0329.604] WbemDefPath:IUnknown:Release (This=0x58f2250) returned 0x1 [0329.604] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.604] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2250, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2250) returned 0x0 [0329.604] WbemDefPath:IUnknown:AddRef (This=0x58f2250) returned 0x3 [0329.604] WbemDefPath:IUnknown:Release (This=0x58f2250) returned 0x2 [0329.604] WbemDefPath:IWbemPath:SetText (This=0x58f2250, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3456\"") returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.604] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.605] IWbemClassObject:Get (in: This=0x58eb048, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2388698*=0, plFlavor=0x238869c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd80, varVal2=0x0), pType=0x2388698*=19, plFlavor=0x238869c*=0) returned 0x0 [0329.605] IWbemClassObject:Get (in: This=0x58eb048, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2388698*=19, plFlavor=0x238869c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd80, varVal2=0x0), pType=0x2388698*=19, plFlavor=0x238869c*=0) returned 0x0 [0329.605] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.605] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.605] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.605] IWbemClassObject:Get (in: This=0x58eb048, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238879c*=0, plFlavor=0x23887a0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x238879c*=8, plFlavor=0x23887a0*=0) returned 0x0 [0329.605] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0329.605] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0329.605] IWbemClassObject:Get (in: This=0x58eb048, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238879c*=8, plFlavor=0x23887a0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="better-then-professional.exe", varVal2=0x0), pType=0x238879c*=8, plFlavor=0x23887a0*=0) returned 0x0 [0329.606] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0329.606] SysStringByteLen (bstr="better-then-professional.exe") returned 0x38 [0329.606] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.606] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.606] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.606] IWbemClassObject:Get (in: This=0x58eb048, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2388920*=0, plFlavor=0x2388924*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ", varVal2=0x0), pType=0x2388920*=8, plFlavor=0x2388924*=0) returned 0x0 [0329.606] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0329.606] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0329.606] IWbemClassObject:Get (in: This=0x58eb048, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2388920*=8, plFlavor=0x2388924*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ", varVal2=0x0), pType=0x2388920*=8, plFlavor=0x2388924*=0) returned 0x0 [0329.606] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0329.606] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\better-then-professional.exe\" ") returned 0x8a [0329.606] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0329.606] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58e9ec0, puReturned=0x2377db0*=0x1) returned 0x0 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e9ec0) returned 0x0 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.609] IUnknown:AddRef (This=0x58e9ec0) returned 0x3 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.609] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e9ec4) returned 0x0 [0329.610] IMarshal:GetUnmarshalClass (in: This=0x58e9ec4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.610] IUnknown:Release (This=0x58e9ec4) returned 0x3 [0329.610] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.610] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.610] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.610] IUnknown:Release (This=0x58e9ec0) returned 0x2 [0329.610] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.610] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.610] IUnknown:QueryInterface (in: This=0x58e9ec0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e9ec0) returned 0x0 [0329.610] IUnknown:AddRef (This=0x58e9ec0) returned 0x4 [0329.610] IUnknown:Release (This=0x58e9ec0) returned 0x3 [0329.610] IUnknown:Release (This=0x58e9ec0) returned 0x2 [0329.610] CoTaskMemFree (pv=0x586b460) [0329.610] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.610] IUnknown:AddRef (This=0x58e9ec0) returned 0x3 [0329.611] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.611] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.611] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0329.611] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x5e [0329.611] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.611] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.611] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.611] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.612] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b380) returned 0x0 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b380, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.613] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b380, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1ae0) returned 0x0 [0329.613] WbemDefPath:IUnknown:Release (This=0x586b380) returned 0x0 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1ae0) returned 0x0 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.613] WbemDefPath:IUnknown:AddRef (This=0x58f1ae0) returned 0x3 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c97d0) returned 0x0 [0329.613] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c97d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.613] WbemDefPath:IUnknown:Release (This=0x58c97d0) returned 0x3 [0329.613] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.614] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.614] WbemDefPath:IUnknown:Release (This=0x58f1ae0) returned 0x2 [0329.614] WbemDefPath:IUnknown:Release (This=0x58f1ae0) returned 0x1 [0329.614] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.614] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ae0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1ae0) returned 0x0 [0329.614] WbemDefPath:IUnknown:AddRef (This=0x58f1ae0) returned 0x3 [0329.614] WbemDefPath:IUnknown:Release (This=0x58f1ae0) returned 0x2 [0329.614] WbemDefPath:IWbemPath:SetText (This=0x58f1ae0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3464\"") returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.614] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.614] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389404*=0, plFlavor=0x2389408*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd88, varVal2=0x0), pType=0x2389404*=19, plFlavor=0x2389408*=0) returned 0x0 [0329.615] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389404*=19, plFlavor=0x2389408*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd88, varVal2=0x0), pType=0x2389404*=19, plFlavor=0x2389408*=0) returned 0x0 [0329.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.615] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.615] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.615] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389508*=0, plFlavor=0x238950c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x2389508*=8, plFlavor=0x238950c*=0) returned 0x0 [0329.615] SysStringByteLen (bstr="yes.exe") returned 0xe [0329.615] SysStringByteLen (bstr="yes.exe") returned 0xe [0329.615] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389508*=8, plFlavor=0x238950c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yes.exe", varVal2=0x0), pType=0x2389508*=8, plFlavor=0x238950c*=0) returned 0x0 [0329.615] SysStringByteLen (bstr="yes.exe") returned 0xe [0329.615] SysStringByteLen (bstr="yes.exe") returned 0xe [0329.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.615] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.615] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.616] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389634*=0, plFlavor=0x2389638*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ", varVal2=0x0), pType=0x2389634*=8, plFlavor=0x2389638*=0) returned 0x0 [0329.616] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0329.616] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0329.616] IWbemClassObject:Get (in: This=0x58e9ec0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2389634*=8, plFlavor=0x2389638*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ", varVal2=0x0), pType=0x2389634*=8, plFlavor=0x2389638*=0) returned 0x0 [0329.616] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0329.616] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\yes.exe\" ") returned 0x5a [0329.616] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0329.616] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x58dff58, puReturned=0x2377db0*=0x1) returned 0x0 [0329.618] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58dff58) returned 0x0 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.619] IUnknown:AddRef (This=0x58dff58) returned 0x3 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58dff5c) returned 0x0 [0329.619] IMarshal:GetUnmarshalClass (in: This=0x58dff5c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.619] IUnknown:Release (This=0x58dff5c) returned 0x3 [0329.619] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.619] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.619] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.619] IUnknown:Release (This=0x58dff58) returned 0x2 [0329.619] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.619] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.620] IUnknown:QueryInterface (in: This=0x58dff58, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58dff58) returned 0x0 [0329.620] IUnknown:AddRef (This=0x58dff58) returned 0x4 [0329.620] IUnknown:Release (This=0x58dff58) returned 0x3 [0329.620] IUnknown:Release (This=0x58dff58) returned 0x2 [0329.620] CoTaskMemFree (pv=0x586b490) [0329.620] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.620] IUnknown:AddRef (This=0x58dff58) returned 0x3 [0329.620] IWbemClassObject:Get (in: This=0x58dff58, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.620] IWbemClassObject:Get (in: This=0x58dff58, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.621] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0329.621] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0329.621] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.621] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.621] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.621] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.622] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0329.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.622] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1b50) returned 0x0 [0329.623] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1b50) returned 0x0 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.623] WbemDefPath:IUnknown:AddRef (This=0x58f1b50) returned 0x3 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.623] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c99c8) returned 0x0 [0329.623] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c99c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.623] WbemDefPath:IUnknown:Release (This=0x58c99c8) returned 0x3 [0329.623] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.624] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.624] WbemDefPath:IUnknown:Release (This=0x58f1b50) returned 0x2 [0329.624] WbemDefPath:IUnknown:Release (This=0x58f1b50) returned 0x1 [0329.624] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.624] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1b50, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1b50) returned 0x0 [0329.624] WbemDefPath:IUnknown:AddRef (This=0x58f1b50) returned 0x3 [0329.624] WbemDefPath:IUnknown:Release (This=0x58f1b50) returned 0x2 [0329.624] WbemDefPath:IWbemPath:SetText (This=0x58f1b50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.624] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.624] IWbemClassObject:Get (in: This=0x58dff58, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a05c*=0, plFlavor=0x238a060*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd9c, varVal2=0x0), pType=0x238a05c*=19, plFlavor=0x238a060*=0) returned 0x0 [0329.625] IWbemClassObject:Get (in: This=0x58dff58, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a05c*=19, plFlavor=0x238a060*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd9c, varVal2=0x0), pType=0x238a05c*=19, plFlavor=0x238a060*=0) returned 0x0 [0329.625] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.625] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.625] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.625] IWbemClassObject:Get (in: This=0x58dff58, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a160*=0, plFlavor=0x238a164*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x238a160*=8, plFlavor=0x238a164*=0) returned 0x0 [0329.625] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0329.625] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0329.625] IWbemClassObject:Get (in: This=0x58dff58, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a160*=8, plFlavor=0x238a164*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="service outside friend.exe", varVal2=0x0), pType=0x238a160*=8, plFlavor=0x238a164*=0) returned 0x0 [0329.625] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0329.625] SysStringByteLen (bstr="service outside friend.exe") returned 0x34 [0329.625] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.625] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.625] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.625] IWbemClassObject:Get (in: This=0x58dff58, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a2dc*=0, plFlavor=0x238a2e0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ", varVal2=0x0), pType=0x238a2dc*=8, plFlavor=0x238a2e0*=0) returned 0x0 [0329.626] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0329.626] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0329.626] IWbemClassObject:Get (in: This=0x58dff58, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238a2dc*=8, plFlavor=0x238a2e0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ", varVal2=0x0), pType=0x238a2dc*=8, plFlavor=0x238a2e0*=0) returned 0x0 [0329.626] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0329.626] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Portable Devices\\service outside friend.exe\" ") returned 0x8e [0329.626] CoTaskMemAlloc (cb=0x4) returned 0x586b360 [0329.626] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b360, puReturned=0x2377db0 | out: apObjects=0x586b360*=0x58e0a80, puReturned=0x2377db0*=0x1) returned 0x0 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0a80) returned 0x0 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.628] IUnknown:AddRef (This=0x58e0a80) returned 0x3 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.628] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e0a84) returned 0x0 [0329.629] IMarshal:GetUnmarshalClass (in: This=0x58e0a84, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.629] IUnknown:Release (This=0x58e0a84) returned 0x3 [0329.629] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.629] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.629] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.629] IUnknown:Release (This=0x58e0a80) returned 0x2 [0329.629] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.629] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.629] IUnknown:QueryInterface (in: This=0x58e0a80, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0a80) returned 0x0 [0329.629] IUnknown:AddRef (This=0x58e0a80) returned 0x4 [0329.629] IUnknown:Release (This=0x58e0a80) returned 0x3 [0329.629] IUnknown:Release (This=0x58e0a80) returned 0x2 [0329.629] CoTaskMemFree (pv=0x586b360) [0329.629] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.629] IUnknown:AddRef (This=0x58e0a80) returned 0x3 [0329.629] IWbemClassObject:Get (in: This=0x58e0a80, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.630] IWbemClassObject:Get (in: This=0x58e0a80, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.630] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0329.630] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x5e [0329.630] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.630] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.630] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.630] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.631] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0329.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.631] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f18b0) returned 0x0 [0329.631] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0329.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f18b0) returned 0x0 [0329.631] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.632] WbemDefPath:IUnknown:AddRef (This=0x58f18b0) returned 0x3 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c9a40) returned 0x0 [0329.632] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c9a40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.632] WbemDefPath:IUnknown:Release (This=0x58c9a40) returned 0x3 [0329.632] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.632] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.632] WbemDefPath:IUnknown:Release (This=0x58f18b0) returned 0x2 [0329.632] WbemDefPath:IUnknown:Release (This=0x58f18b0) returned 0x1 [0329.632] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.632] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.632] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f18b0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f18b0) returned 0x0 [0329.633] WbemDefPath:IUnknown:AddRef (This=0x58f18b0) returned 0x3 [0329.633] WbemDefPath:IUnknown:Release (This=0x58f18b0) returned 0x2 [0329.633] WbemDefPath:IWbemPath:SetText (This=0x58f18b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3492\"") returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.633] IWbemClassObject:Get (in: This=0x58e0a80, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238adc8*=0, plFlavor=0x238adcc*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xda4, varVal2=0x0), pType=0x238adc8*=19, plFlavor=0x238adcc*=0) returned 0x0 [0329.633] IWbemClassObject:Get (in: This=0x58e0a80, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238adc8*=19, plFlavor=0x238adcc*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xda4, varVal2=0x0), pType=0x238adc8*=19, plFlavor=0x238adcc*=0) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.633] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.633] IWbemClassObject:Get (in: This=0x58e0a80, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238aecc*=0, plFlavor=0x238aed0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x238aecc*=8, plFlavor=0x238aed0*=0) returned 0x0 [0329.634] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0329.634] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0329.634] IWbemClassObject:Get (in: This=0x58e0a80, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238aecc*=8, plFlavor=0x238aed0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="into-large.exe", varVal2=0x0), pType=0x238aecc*=8, plFlavor=0x238aed0*=0) returned 0x0 [0329.634] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0329.634] SysStringByteLen (bstr="into-large.exe") returned 0x1c [0329.634] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.634] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.634] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.634] IWbemClassObject:Get (in: This=0x58e0a80, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238b018*=0, plFlavor=0x238b01c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ", varVal2=0x0), pType=0x238b018*=8, plFlavor=0x238b01c*=0) returned 0x0 [0329.634] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0329.634] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0329.634] IWbemClassObject:Get (in: This=0x58e0a80, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238b018*=8, plFlavor=0x238b01c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ", varVal2=0x0), pType=0x238b018*=8, plFlavor=0x238b01c*=0) returned 0x0 [0329.634] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0329.634] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\into-large.exe\" ") returned 0x70 [0329.635] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0329.635] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58df298, puReturned=0x2377db0*=0x1) returned 0x0 [0329.751] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df298) returned 0x0 [0329.752] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.752] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.752] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.753] IUnknown:AddRef (This=0x58df298) returned 0x3 [0329.753] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.753] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.753] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df29c) returned 0x0 [0329.753] IMarshal:GetUnmarshalClass (in: This=0x58df29c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.753] IUnknown:Release (This=0x58df29c) returned 0x3 [0329.753] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.753] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.753] IUnknown:QueryInterface (in: This=0x58df298, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.754] IUnknown:Release (This=0x58df298) returned 0x2 [0329.754] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.754] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.754] IUnknown:QueryInterface (in: This=0x58df298, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df298) returned 0x0 [0329.754] IUnknown:AddRef (This=0x58df298) returned 0x4 [0329.754] IUnknown:Release (This=0x58df298) returned 0x3 [0329.754] IUnknown:Release (This=0x58df298) returned 0x2 [0329.754] CoTaskMemFree (pv=0x586b340) [0329.754] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.754] IUnknown:AddRef (This=0x58df298) returned 0x3 [0329.754] IWbemClassObject:Get (in: This=0x58df298, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.755] IWbemClassObject:Get (in: This=0x58df298, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.755] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0329.755] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x5e [0329.755] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.755] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.755] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.755] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.763] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0329.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.782] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2410) returned 0x0 [0329.782] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0329.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2410) returned 0x0 [0329.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.783] WbemDefPath:IUnknown:AddRef (This=0x58f2410) returned 0x3 [0329.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c9d40) returned 0x0 [0329.783] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c9d40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.783] WbemDefPath:IUnknown:Release (This=0x58c9d40) returned 0x3 [0329.783] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.784] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.784] WbemDefPath:IUnknown:Release (This=0x58f2410) returned 0x2 [0329.784] WbemDefPath:IUnknown:Release (This=0x58f2410) returned 0x1 [0329.784] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.784] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2410, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2410) returned 0x0 [0329.784] WbemDefPath:IUnknown:AddRef (This=0x58f2410) returned 0x3 [0329.784] WbemDefPath:IUnknown:Release (This=0x58f2410) returned 0x2 [0329.784] WbemDefPath:IWbemPath:SetText (This=0x58f2410, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3512\"") returned 0x0 [0329.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.785] IWbemClassObject:Get (in: This=0x58df298, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ba94*=0, plFlavor=0x238ba98*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdb8, varVal2=0x0), pType=0x238ba94*=19, plFlavor=0x238ba98*=0) returned 0x0 [0329.785] IWbemClassObject:Get (in: This=0x58df298, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ba94*=19, plFlavor=0x238ba98*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdb8, varVal2=0x0), pType=0x238ba94*=19, plFlavor=0x238ba98*=0) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.785] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.785] IWbemClassObject:Get (in: This=0x58df298, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238bb98*=0, plFlavor=0x238bb9c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x238bb98*=8, plFlavor=0x238bb9c*=0) returned 0x0 [0329.796] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0329.796] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0329.796] IWbemClassObject:Get (in: This=0x58df298, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238bb98*=8, plFlavor=0x238bb9c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject_whether.exe", varVal2=0x0), pType=0x238bb98*=8, plFlavor=0x238bb9c*=0) returned 0x0 [0329.796] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0329.796] SysStringByteLen (bstr="subject_whether.exe") returned 0x26 [0329.796] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.796] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.796] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.797] IWbemClassObject:Get (in: This=0x58df298, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238bcf4*=0, plFlavor=0x238bcf8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\subject_whether.exe\" ", varVal2=0x0), pType=0x238bcf4*=8, plFlavor=0x238bcf8*=0) returned 0x0 [0329.797] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0329.797] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0329.797] IWbemClassObject:Get (in: This=0x58df298, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238bcf4*=8, plFlavor=0x238bcf8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\subject_whether.exe\" ", varVal2=0x0), pType=0x238bcf4*=8, plFlavor=0x238bcf8*=0) returned 0x0 [0329.797] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0329.797] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\subject_whether.exe\" ") returned 0x58 [0329.797] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0329.797] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58e00f0, puReturned=0x2377db0*=0x1) returned 0x0 [0329.854] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e00f0) returned 0x0 [0329.854] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.854] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.855] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.855] IUnknown:AddRef (This=0x58e00f0) returned 0x3 [0329.855] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.855] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.855] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e00f4) returned 0x0 [0329.855] IMarshal:GetUnmarshalClass (in: This=0x58e00f4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.856] IUnknown:Release (This=0x58e00f4) returned 0x3 [0329.856] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.856] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.856] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.856] IUnknown:Release (This=0x58e00f0) returned 0x2 [0329.856] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.856] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.856] IUnknown:QueryInterface (in: This=0x58e00f0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e00f0) returned 0x0 [0329.856] IUnknown:AddRef (This=0x58e00f0) returned 0x4 [0329.857] IUnknown:Release (This=0x58e00f0) returned 0x3 [0329.857] IUnknown:Release (This=0x58e00f0) returned 0x2 [0329.857] CoTaskMemFree (pv=0x586b2e0) [0329.857] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.857] IUnknown:AddRef (This=0x58e00f0) returned 0x3 [0329.857] IWbemClassObject:Get (in: This=0x58e00f0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.857] IWbemClassObject:Get (in: This=0x58e00f0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.857] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0329.857] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x5e [0329.858] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.858] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.858] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.858] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.860] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.863] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1d10) returned 0x0 [0329.864] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1d10) returned 0x0 [0329.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.865] WbemDefPath:IUnknown:AddRef (This=0x58f1d10) returned 0x3 [0329.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c9b18) returned 0x0 [0329.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c9b18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.865] WbemDefPath:IUnknown:Release (This=0x58c9b18) returned 0x3 [0329.865] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.866] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.866] WbemDefPath:IUnknown:Release (This=0x58f1d10) returned 0x2 [0329.866] WbemDefPath:IUnknown:Release (This=0x58f1d10) returned 0x1 [0329.866] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.866] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d10, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1d10) returned 0x0 [0329.866] WbemDefPath:IUnknown:AddRef (This=0x58f1d10) returned 0x3 [0329.866] WbemDefPath:IUnknown:Release (This=0x58f1d10) returned 0x2 [0329.866] WbemDefPath:IWbemPath:SetText (This=0x58f1d10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3520\"") returned 0x0 [0329.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.866] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.867] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.867] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.867] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.867] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.867] IWbemClassObject:Get (in: This=0x58e00f0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c734*=0, plFlavor=0x238c738*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x238c734*=19, plFlavor=0x238c738*=0) returned 0x0 [0329.867] IWbemClassObject:Get (in: This=0x58e00f0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c734*=19, plFlavor=0x238c738*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdc0, varVal2=0x0), pType=0x238c734*=19, plFlavor=0x238c738*=0) returned 0x0 [0329.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.868] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.868] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.868] IWbemClassObject:Get (in: This=0x58e00f0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c838*=0, plFlavor=0x238c83c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x238c838*=8, plFlavor=0x238c83c*=0) returned 0x0 [0329.868] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0329.868] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0329.868] IWbemClassObject:Get (in: This=0x58e00f0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c838*=8, plFlavor=0x238c83c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="strategy.exe", varVal2=0x0), pType=0x238c838*=8, plFlavor=0x238c83c*=0) returned 0x0 [0329.868] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0329.868] SysStringByteLen (bstr="strategy.exe") returned 0x18 [0329.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.869] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.869] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.869] IWbemClassObject:Get (in: This=0x58e00f0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c97c*=0, plFlavor=0x238c980*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ", varVal2=0x0), pType=0x238c97c*=8, plFlavor=0x238c980*=0) returned 0x0 [0329.869] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0329.869] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0329.869] IWbemClassObject:Get (in: This=0x58e00f0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238c97c*=8, plFlavor=0x238c980*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ", varVal2=0x0), pType=0x238c97c*=8, plFlavor=0x238c980*=0) returned 0x0 [0329.869] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0329.869] SysStringByteLen (bstr="\"C:\\Program Files\\Internet Explorer\\strategy.exe\" ") returned 0x64 [0329.870] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0329.870] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58e0288, puReturned=0x2377db0*=0x1) returned 0x0 [0329.875] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0288) returned 0x0 [0329.875] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.875] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.875] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.876] IUnknown:AddRef (This=0x58e0288) returned 0x3 [0329.876] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.876] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.876] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e028c) returned 0x0 [0329.876] IMarshal:GetUnmarshalClass (in: This=0x58e028c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.876] IUnknown:Release (This=0x58e028c) returned 0x3 [0329.876] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.876] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.876] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.876] IUnknown:Release (This=0x58e0288) returned 0x2 [0329.876] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.878] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.878] IUnknown:QueryInterface (in: This=0x58e0288, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0288) returned 0x0 [0329.878] IUnknown:AddRef (This=0x58e0288) returned 0x4 [0329.878] IUnknown:Release (This=0x58e0288) returned 0x3 [0329.878] IUnknown:Release (This=0x58e0288) returned 0x2 [0329.878] CoTaskMemFree (pv=0x586b460) [0329.878] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.878] IUnknown:AddRef (This=0x58e0288) returned 0x3 [0329.878] IWbemClassObject:Get (in: This=0x58e0288, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.878] IWbemClassObject:Get (in: This=0x58e0288, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.878] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0329.878] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x5e [0329.879] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.879] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.879] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.879] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.883] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0329.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.894] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1fb0) returned 0x0 [0329.895] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1fb0) returned 0x0 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.895] WbemDefPath:IUnknown:AddRef (This=0x58f1fb0) returned 0x3 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58c9f50) returned 0x0 [0329.896] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58c9f50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.896] WbemDefPath:IUnknown:Release (This=0x58c9f50) returned 0x3 [0329.896] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.896] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.896] WbemDefPath:IUnknown:Release (This=0x58f1fb0) returned 0x2 [0329.896] WbemDefPath:IUnknown:Release (This=0x58f1fb0) returned 0x1 [0329.896] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.896] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1fb0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1fb0) returned 0x0 [0329.896] WbemDefPath:IUnknown:AddRef (This=0x58f1fb0) returned 0x3 [0329.896] WbemDefPath:IUnknown:Release (This=0x58f1fb0) returned 0x2 [0329.896] WbemDefPath:IWbemPath:SetText (This=0x58f1fb0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3540\"") returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.897] IWbemClassObject:Get (in: This=0x58e0288, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d3d0*=0, plFlavor=0x238d3d4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd4, varVal2=0x0), pType=0x238d3d0*=19, plFlavor=0x238d3d4*=0) returned 0x0 [0329.897] IWbemClassObject:Get (in: This=0x58e0288, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d3d0*=19, plFlavor=0x238d3d4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd4, varVal2=0x0), pType=0x238d3d0*=19, plFlavor=0x238d3d4*=0) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.897] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.897] IWbemClassObject:Get (in: This=0x58e0288, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d4d4*=0, plFlavor=0x238d4d8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x238d4d4*=8, plFlavor=0x238d4d8*=0) returned 0x0 [0329.898] SysStringByteLen (bstr="spend.exe") returned 0x12 [0329.898] SysStringByteLen (bstr="spend.exe") returned 0x12 [0329.898] IWbemClassObject:Get (in: This=0x58e0288, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d4d4*=8, plFlavor=0x238d4d8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spend.exe", varVal2=0x0), pType=0x238d4d4*=8, plFlavor=0x238d4d8*=0) returned 0x0 [0329.898] SysStringByteLen (bstr="spend.exe") returned 0x12 [0329.898] SysStringByteLen (bstr="spend.exe") returned 0x12 [0329.898] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.898] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.898] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.898] IWbemClassObject:Get (in: This=0x58e0288, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d608*=0, plFlavor=0x238d60c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ", varVal2=0x0), pType=0x238d608*=8, plFlavor=0x238d60c*=0) returned 0x0 [0329.898] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0329.898] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0329.898] IWbemClassObject:Get (in: This=0x58e0288, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238d608*=8, plFlavor=0x238d60c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ", varVal2=0x0), pType=0x238d608*=8, plFlavor=0x238d60c*=0) returned 0x0 [0329.898] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0329.899] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\spend.exe\" ") returned 0x68 [0329.899] CoTaskMemAlloc (cb=0x4) returned 0x586b380 [0329.899] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b380, puReturned=0x2377db0 | out: apObjects=0x586b380*=0x58df100, puReturned=0x2377db0*=0x1) returned 0x0 [0329.901] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df100) returned 0x0 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.902] IUnknown:AddRef (This=0x58df100) returned 0x3 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.902] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df104) returned 0x0 [0329.902] IMarshal:GetUnmarshalClass (in: This=0x58df104, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.903] IUnknown:Release (This=0x58df104) returned 0x3 [0329.903] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.903] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.903] IUnknown:QueryInterface (in: This=0x58df100, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.903] IUnknown:Release (This=0x58df100) returned 0x2 [0329.903] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.903] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.903] IUnknown:QueryInterface (in: This=0x58df100, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df100) returned 0x0 [0329.903] IUnknown:AddRef (This=0x58df100) returned 0x4 [0329.903] IUnknown:Release (This=0x58df100) returned 0x3 [0329.903] IUnknown:Release (This=0x58df100) returned 0x2 [0329.903] CoTaskMemFree (pv=0x586b380) [0329.903] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.903] IUnknown:AddRef (This=0x58df100) returned 0x3 [0329.903] IWbemClassObject:Get (in: This=0x58df100, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.904] IWbemClassObject:Get (in: This=0x58df100, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.904] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0329.904] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x5e [0329.904] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.904] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.904] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.904] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.905] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.905] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.905] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f22c0) returned 0x0 [0329.953] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.957] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f22c0) returned 0x0 [0329.957] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.957] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.958] WbemDefPath:IUnknown:AddRef (This=0x58f22c0) returned 0x3 [0329.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x5897320) returned 0x0 [0329.958] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5897320, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.958] WbemDefPath:IUnknown:Release (This=0x5897320) returned 0x3 [0329.958] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.958] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.958] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.958] WbemDefPath:IUnknown:Release (This=0x58f22c0) returned 0x2 [0329.958] WbemDefPath:IUnknown:Release (This=0x58f22c0) returned 0x1 [0329.958] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.959] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.959] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f22c0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f22c0) returned 0x0 [0329.959] WbemDefPath:IUnknown:AddRef (This=0x58f22c0) returned 0x3 [0329.959] WbemDefPath:IUnknown:Release (This=0x58f22c0) returned 0x2 [0329.959] WbemDefPath:IWbemPath:SetText (This=0x58f22c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3548\"") returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.960] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.960] IWbemClassObject:Get (in: This=0x58df100, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e064*=0, plFlavor=0x238e068*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xddc, varVal2=0x0), pType=0x238e064*=19, plFlavor=0x238e068*=0) returned 0x0 [0329.960] IWbemClassObject:Get (in: This=0x58df100, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e064*=19, plFlavor=0x238e068*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xddc, varVal2=0x0), pType=0x238e064*=19, plFlavor=0x238e068*=0) returned 0x0 [0329.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.961] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.961] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.961] IWbemClassObject:Get (in: This=0x58df100, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e168*=0, plFlavor=0x238e16c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x238e168*=8, plFlavor=0x238e16c*=0) returned 0x0 [0329.961] SysStringByteLen (bstr="fall.exe") returned 0x10 [0329.961] SysStringByteLen (bstr="fall.exe") returned 0x10 [0329.961] IWbemClassObject:Get (in: This=0x58df100, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e168*=8, plFlavor=0x238e16c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fall.exe", varVal2=0x0), pType=0x238e168*=8, plFlavor=0x238e16c*=0) returned 0x0 [0329.961] SysStringByteLen (bstr="fall.exe") returned 0x10 [0329.961] SysStringByteLen (bstr="fall.exe") returned 0x10 [0329.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.961] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.961] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.962] IWbemClassObject:Get (in: This=0x58df100, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e29c*=0, plFlavor=0x238e2a0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ", varVal2=0x0), pType=0x238e29c*=8, plFlavor=0x238e2a0*=0) returned 0x0 [0329.962] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0329.962] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0329.962] IWbemClassObject:Get (in: This=0x58df100, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238e29c*=8, plFlavor=0x238e2a0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ", varVal2=0x0), pType=0x238e29c*=8, plFlavor=0x238e2a0*=0) returned 0x0 [0329.962] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0329.962] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fall.exe\" ") returned 0x68 [0329.962] CoTaskMemAlloc (cb=0x4) returned 0x586b360 [0329.962] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b360, puReturned=0x2377db0 | out: apObjects=0x586b360*=0x58e0c18, puReturned=0x2377db0*=0x1) returned 0x0 [0329.966] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0c18) returned 0x0 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.967] IUnknown:AddRef (This=0x58e0c18) returned 0x3 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.967] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e0c1c) returned 0x0 [0329.968] IMarshal:GetUnmarshalClass (in: This=0x58e0c1c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.968] IUnknown:Release (This=0x58e0c1c) returned 0x3 [0329.968] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.971] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.971] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.971] IUnknown:Release (This=0x58e0c18) returned 0x2 [0329.971] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.971] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.971] IUnknown:QueryInterface (in: This=0x58e0c18, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0c18) returned 0x0 [0329.971] IUnknown:AddRef (This=0x58e0c18) returned 0x4 [0329.972] IUnknown:Release (This=0x58e0c18) returned 0x3 [0329.972] IUnknown:Release (This=0x58e0c18) returned 0x2 [0329.972] CoTaskMemFree (pv=0x586b360) [0329.972] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.972] IUnknown:AddRef (This=0x58e0c18) returned 0x3 [0329.972] IWbemClassObject:Get (in: This=0x58e0c18, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.972] IWbemClassObject:Get (in: This=0x58e0c18, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.973] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0329.973] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x5e [0329.973] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.974] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.974] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.974] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.975] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0329.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.975] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2020) returned 0x0 [0329.975] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0329.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2020) returned 0x0 [0329.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.975] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.976] WbemDefPath:IUnknown:AddRef (This=0x58f2020) returned 0x3 [0329.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f51f0) returned 0x0 [0329.976] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f51f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.976] WbemDefPath:IUnknown:Release (This=0x58f51f0) returned 0x3 [0329.976] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.976] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.976] WbemDefPath:IUnknown:Release (This=0x58f2020) returned 0x2 [0329.976] WbemDefPath:IUnknown:Release (This=0x58f2020) returned 0x1 [0329.976] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.977] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2020, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2020) returned 0x0 [0329.977] WbemDefPath:IUnknown:AddRef (This=0x58f2020) returned 0x3 [0329.977] WbemDefPath:IUnknown:Release (This=0x58f2020) returned 0x2 [0329.977] WbemDefPath:IWbemPath:SetText (This=0x58f2020, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3564\"") returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.977] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.977] IWbemClassObject:Get (in: This=0x58e0c18, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ecf4*=0, plFlavor=0x238ecf8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdec, varVal2=0x0), pType=0x238ecf4*=19, plFlavor=0x238ecf8*=0) returned 0x0 [0329.977] IWbemClassObject:Get (in: This=0x58e0c18, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ecf4*=19, plFlavor=0x238ecf8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdec, varVal2=0x0), pType=0x238ecf4*=19, plFlavor=0x238ecf8*=0) returned 0x0 [0329.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.978] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.978] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.978] IWbemClassObject:Get (in: This=0x58e0c18, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238edf8*=0, plFlavor=0x238edfc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x238edf8*=8, plFlavor=0x238edfc*=0) returned 0x0 [0329.978] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0329.978] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0329.978] IWbemClassObject:Get (in: This=0x58e0c18, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238edf8*=8, plFlavor=0x238edfc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="3dftp.exe", varVal2=0x0), pType=0x238edf8*=8, plFlavor=0x238edfc*=0) returned 0x0 [0329.978] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0329.978] SysStringByteLen (bstr="3dftp.exe") returned 0x12 [0329.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.978] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.978] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.978] IWbemClassObject:Get (in: This=0x58e0c18, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ef2c*=0, plFlavor=0x238ef30*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x238ef2c*=8, plFlavor=0x238ef30*=0) returned 0x0 [0329.979] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0329.979] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0329.979] IWbemClassObject:Get (in: This=0x58e0c18, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238ef2c*=8, plFlavor=0x238ef30*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ", varVal2=0x0), pType=0x238ef2c*=8, plFlavor=0x238ef30*=0) returned 0x0 [0329.979] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0329.979] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Sidebar\\3dftp.exe\" ") returned 0x5a [0329.979] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0329.979] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x58df430, puReturned=0x2377db0*=0x1) returned 0x0 [0329.980] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df430) returned 0x0 [0329.980] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.980] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.980] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.981] IUnknown:AddRef (This=0x58df430) returned 0x3 [0329.981] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.981] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.981] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df434) returned 0x0 [0329.981] IMarshal:GetUnmarshalClass (in: This=0x58df434, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.981] IUnknown:Release (This=0x58df434) returned 0x3 [0329.981] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.981] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.981] IUnknown:QueryInterface (in: This=0x58df430, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.981] IUnknown:Release (This=0x58df430) returned 0x2 [0329.981] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.981] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.981] IUnknown:QueryInterface (in: This=0x58df430, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df430) returned 0x0 [0329.982] IUnknown:AddRef (This=0x58df430) returned 0x4 [0329.982] IUnknown:Release (This=0x58df430) returned 0x3 [0329.982] IUnknown:Release (This=0x58df430) returned 0x2 [0329.982] CoTaskMemFree (pv=0x586b490) [0329.982] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.982] IUnknown:AddRef (This=0x58df430) returned 0x3 [0329.982] IWbemClassObject:Get (in: This=0x58df430, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.982] IWbemClassObject:Get (in: This=0x58df430, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.982] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0329.982] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x5e [0329.982] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.982] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.982] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.983] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.983] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0329.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0329.988] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1ca0) returned 0x0 [0329.988] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0329.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1ca0) returned 0x0 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0329.989] WbemDefPath:IUnknown:AddRef (This=0x58f1ca0) returned 0x3 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5178) returned 0x0 [0329.989] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5178, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0329.989] WbemDefPath:IUnknown:Release (This=0x58f5178) returned 0x3 [0329.989] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0329.989] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0329.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0329.989] WbemDefPath:IUnknown:Release (This=0x58f1ca0) returned 0x2 [0329.990] WbemDefPath:IUnknown:Release (This=0x58f1ca0) returned 0x1 [0329.990] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0329.990] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0329.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ca0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1ca0) returned 0x0 [0329.990] WbemDefPath:IUnknown:AddRef (This=0x58f1ca0) returned 0x3 [0329.990] WbemDefPath:IUnknown:Release (This=0x58f1ca0) returned 0x2 [0329.990] WbemDefPath:IWbemPath:SetText (This=0x58f1ca0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3572\"") returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.990] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.990] IWbemClassObject:Get (in: This=0x58df430, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238f958*=0, plFlavor=0x238f95c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf4, varVal2=0x0), pType=0x238f958*=19, plFlavor=0x238f95c*=0) returned 0x0 [0329.990] IWbemClassObject:Get (in: This=0x58df430, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238f958*=19, plFlavor=0x238f95c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xdf4, varVal2=0x0), pType=0x238f958*=19, plFlavor=0x238f95c*=0) returned 0x0 [0329.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.991] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.991] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.991] IWbemClassObject:Get (in: This=0x58df430, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238fa5c*=0, plFlavor=0x238fa60*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x238fa5c*=8, plFlavor=0x238fa60*=0) returned 0x0 [0329.991] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0329.991] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0329.991] IWbemClassObject:Get (in: This=0x58df430, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238fa5c*=8, plFlavor=0x238fa60*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="absolutetelnet.exe", varVal2=0x0), pType=0x238fa5c*=8, plFlavor=0x238fa60*=0) returned 0x0 [0329.991] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0329.991] SysStringByteLen (bstr="absolutetelnet.exe") returned 0x24 [0329.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0329.991] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0329.991] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0329.991] IWbemClassObject:Get (in: This=0x58df430, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238fbb8*=0, plFlavor=0x238fbbc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x238fbb8*=8, plFlavor=0x238fbbc*=0) returned 0x0 [0329.992] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0329.992] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0329.992] IWbemClassObject:Get (in: This=0x58df430, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x238fbb8*=8, plFlavor=0x238fbbc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ", varVal2=0x0), pType=0x238fbb8*=8, plFlavor=0x238fbbc*=0) returned 0x0 [0329.992] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0329.992] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\absolutetelnet.exe\" ") returned 0x76 [0329.992] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0329.992] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58e0420, puReturned=0x2377db0*=0x1) returned 0x0 [0329.995] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0420) returned 0x0 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0329.996] IUnknown:AddRef (This=0x58e0420) returned 0x3 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0329.996] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e0424) returned 0x0 [0329.996] IMarshal:GetUnmarshalClass (in: This=0x58e0424, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0329.996] IUnknown:Release (This=0x58e0424) returned 0x3 [0329.996] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0329.997] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0329.997] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0329.997] IUnknown:Release (This=0x58e0420) returned 0x2 [0329.997] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0329.997] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0329.997] IUnknown:QueryInterface (in: This=0x58e0420, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0420) returned 0x0 [0329.997] IUnknown:AddRef (This=0x58e0420) returned 0x4 [0329.997] IUnknown:Release (This=0x58e0420) returned 0x3 [0329.997] IUnknown:Release (This=0x58e0420) returned 0x2 [0329.997] CoTaskMemFree (pv=0x586b2e0) [0329.997] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0329.997] IUnknown:AddRef (This=0x58e0420) returned 0x3 [0329.997] IWbemClassObject:Get (in: This=0x58e0420, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0329.997] IWbemClassObject:Get (in: This=0x58e0420, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0329.997] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0329.998] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x5e [0329.998] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0329.998] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0329.998] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0329.998] IUnknown:Release (This=0x692bc4) returned 0x1 [0329.999] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.051] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1920) returned 0x0 [0330.052] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1920) returned 0x0 [0330.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.053] WbemDefPath:IUnknown:AddRef (This=0x58f1920) returned 0x3 [0330.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.053] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5580) returned 0x0 [0330.053] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5580, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.054] WbemDefPath:IUnknown:Release (This=0x58f5580) returned 0x3 [0330.054] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.054] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.054] WbemDefPath:IUnknown:Release (This=0x58f1920) returned 0x2 [0330.054] WbemDefPath:IUnknown:Release (This=0x58f1920) returned 0x1 [0330.054] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.055] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1920, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1920) returned 0x0 [0330.055] WbemDefPath:IUnknown:AddRef (This=0x58f1920) returned 0x3 [0330.055] WbemDefPath:IUnknown:Release (This=0x58f1920) returned 0x2 [0330.055] WbemDefPath:IWbemPath:SetText (This=0x58f1920, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3584\"") returned 0x0 [0330.055] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.055] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.056] IWbemClassObject:Get (in: This=0x58e0420, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239064c*=0, plFlavor=0x2390650*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x239064c*=19, plFlavor=0x2390650*=0) returned 0x0 [0330.056] IWbemClassObject:Get (in: This=0x58e0420, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239064c*=19, plFlavor=0x2390650*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe00, varVal2=0x0), pType=0x239064c*=19, plFlavor=0x2390650*=0) returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.056] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.056] IWbemClassObject:Get (in: This=0x58e0420, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2390750*=0, plFlavor=0x2390754*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2390750*=8, plFlavor=0x2390754*=0) returned 0x0 [0330.057] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0330.057] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0330.057] IWbemClassObject:Get (in: This=0x58e0420, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2390750*=8, plFlavor=0x2390754*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alftp.exe", varVal2=0x0), pType=0x2390750*=8, plFlavor=0x2390754*=0) returned 0x0 [0330.057] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0330.057] SysStringByteLen (bstr="alftp.exe") returned 0x12 [0330.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.057] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.057] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.057] IWbemClassObject:Get (in: This=0x58e0420, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2390884*=0, plFlavor=0x2390888*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ", varVal2=0x0), pType=0x2390884*=8, plFlavor=0x2390888*=0) returned 0x0 [0330.057] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0330.057] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0330.057] IWbemClassObject:Get (in: This=0x58e0420, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2390884*=8, plFlavor=0x2390888*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ", varVal2=0x0), pType=0x2390884*=8, plFlavor=0x2390888*=0) returned 0x0 [0330.058] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0330.058] SysStringByteLen (bstr="\"C:\\Program Files\\Uninstall Information\\alftp.exe\" ") returned 0x66 [0330.058] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0330.058] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x58dfc28, puReturned=0x2377db0*=0x1) returned 0x0 [0330.059] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58dfc28) returned 0x0 [0330.059] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.059] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.059] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.060] IUnknown:AddRef (This=0x58dfc28) returned 0x3 [0330.060] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.060] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.060] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58dfc2c) returned 0x0 [0330.060] IMarshal:GetUnmarshalClass (in: This=0x58dfc2c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.060] IUnknown:Release (This=0x58dfc2c) returned 0x3 [0330.060] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.060] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.060] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.060] IUnknown:Release (This=0x58dfc28) returned 0x2 [0330.060] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.060] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.060] IUnknown:QueryInterface (in: This=0x58dfc28, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58dfc28) returned 0x0 [0330.060] IUnknown:AddRef (This=0x58dfc28) returned 0x4 [0330.060] IUnknown:Release (This=0x58dfc28) returned 0x3 [0330.060] IUnknown:Release (This=0x58dfc28) returned 0x2 [0330.060] CoTaskMemFree (pv=0x586b490) [0330.061] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.061] IUnknown:AddRef (This=0x58dfc28) returned 0x3 [0330.061] IWbemClassObject:Get (in: This=0x58dfc28, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.061] IWbemClassObject:Get (in: This=0x58dfc28, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.061] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0330.061] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x5e [0330.061] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.061] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.061] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.061] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.066] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0330.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1840) returned 0x0 [0330.066] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0330.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1840) returned 0x0 [0330.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.067] WbemDefPath:IUnknown:AddRef (This=0x58f1840) returned 0x3 [0330.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f58b0) returned 0x0 [0330.067] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f58b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.067] WbemDefPath:IUnknown:Release (This=0x58f58b0) returned 0x3 [0330.067] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.067] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.067] WbemDefPath:IUnknown:Release (This=0x58f1840) returned 0x2 [0330.067] WbemDefPath:IUnknown:Release (This=0x58f1840) returned 0x1 [0330.067] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.067] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1840, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1840) returned 0x0 [0330.067] WbemDefPath:IUnknown:AddRef (This=0x58f1840) returned 0x3 [0330.068] WbemDefPath:IUnknown:Release (This=0x58f1840) returned 0x2 [0330.068] WbemDefPath:IWbemPath:SetText (This=0x58f1840, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3596\"") returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.068] IWbemClassObject:Get (in: This=0x58dfc28, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23912d4*=0, plFlavor=0x23912d8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe0c, varVal2=0x0), pType=0x23912d4*=19, plFlavor=0x23912d8*=0) returned 0x0 [0330.068] IWbemClassObject:Get (in: This=0x58dfc28, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23912d4*=19, plFlavor=0x23912d8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe0c, varVal2=0x0), pType=0x23912d4*=19, plFlavor=0x23912d8*=0) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.068] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.069] IWbemClassObject:Get (in: This=0x58dfc28, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23913d8*=0, plFlavor=0x23913dc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x23913d8*=8, plFlavor=0x23913dc*=0) returned 0x0 [0330.069] SysStringByteLen (bstr="barca.exe") returned 0x12 [0330.069] SysStringByteLen (bstr="barca.exe") returned 0x12 [0330.069] IWbemClassObject:Get (in: This=0x58dfc28, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23913d8*=8, plFlavor=0x23913dc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="barca.exe", varVal2=0x0), pType=0x23913d8*=8, plFlavor=0x23913dc*=0) returned 0x0 [0330.069] SysStringByteLen (bstr="barca.exe") returned 0x12 [0330.069] SysStringByteLen (bstr="barca.exe") returned 0x12 [0330.069] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.069] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.069] IWbemClassObject:Get (in: This=0x58dfc28, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239150c*=0, plFlavor=0x2391510*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\barca.exe\" ", varVal2=0x0), pType=0x239150c*=8, plFlavor=0x2391510*=0) returned 0x0 [0330.069] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0330.069] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0330.070] IWbemClassObject:Get (in: This=0x58dfc28, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239150c*=8, plFlavor=0x2391510*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows NT\\barca.exe\" ", varVal2=0x0), pType=0x239150c*=8, plFlavor=0x2391510*=0) returned 0x0 [0330.070] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0330.070] SysStringByteLen (bstr="\"C:\\Program Files\\Windows NT\\barca.exe\" ") returned 0x50 [0330.070] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0330.070] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58e05b8, puReturned=0x2377db0*=0x1) returned 0x0 [0330.072] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e05b8) returned 0x0 [0330.072] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.072] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.073] IUnknown:AddRef (This=0x58e05b8) returned 0x3 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e05bc) returned 0x0 [0330.073] IMarshal:GetUnmarshalClass (in: This=0x58e05bc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.073] IUnknown:Release (This=0x58e05bc) returned 0x3 [0330.073] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.073] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.073] IUnknown:Release (This=0x58e05b8) returned 0x2 [0330.073] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.073] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.073] IUnknown:QueryInterface (in: This=0x58e05b8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e05b8) returned 0x0 [0330.074] IUnknown:AddRef (This=0x58e05b8) returned 0x4 [0330.074] IUnknown:Release (This=0x58e05b8) returned 0x3 [0330.074] IUnknown:Release (This=0x58e05b8) returned 0x2 [0330.074] CoTaskMemFree (pv=0x586b340) [0330.074] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.074] IUnknown:AddRef (This=0x58e05b8) returned 0x3 [0330.074] IWbemClassObject:Get (in: This=0x58e05b8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.074] IWbemClassObject:Get (in: This=0x58e05b8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.074] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0330.074] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x5e [0330.074] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.075] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.075] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.075] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.076] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.076] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2330) returned 0x0 [0330.076] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2330) returned 0x0 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.076] WbemDefPath:IUnknown:AddRef (This=0x58f2330) returned 0x3 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f59b8) returned 0x0 [0330.077] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f59b8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.077] WbemDefPath:IUnknown:Release (This=0x58f59b8) returned 0x3 [0330.077] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.077] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.077] WbemDefPath:IUnknown:Release (This=0x58f2330) returned 0x2 [0330.077] WbemDefPath:IUnknown:Release (This=0x58f2330) returned 0x1 [0330.077] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.077] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2330, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2330) returned 0x0 [0330.077] WbemDefPath:IUnknown:AddRef (This=0x58f2330) returned 0x3 [0330.127] WbemDefPath:IUnknown:Release (This=0x58f2330) returned 0x2 [0330.128] WbemDefPath:IWbemPath:SetText (This=0x58f2330, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3604\"") returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.128] IWbemClassObject:Get (in: This=0x58e05b8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2391f20*=0, plFlavor=0x2391f24*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe14, varVal2=0x0), pType=0x2391f20*=19, plFlavor=0x2391f24*=0) returned 0x0 [0330.128] IWbemClassObject:Get (in: This=0x58e05b8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2391f20*=19, plFlavor=0x2391f24*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe14, varVal2=0x0), pType=0x2391f20*=19, plFlavor=0x2391f24*=0) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.128] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.128] IWbemClassObject:Get (in: This=0x58e05b8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392024*=0, plFlavor=0x2392028*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2392024*=8, plFlavor=0x2392028*=0) returned 0x0 [0330.129] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0330.129] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0330.129] IWbemClassObject:Get (in: This=0x58e05b8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392024*=8, plFlavor=0x2392028*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="bitkinex.exe", varVal2=0x0), pType=0x2392024*=8, plFlavor=0x2392028*=0) returned 0x0 [0330.129] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0330.129] SysStringByteLen (bstr="bitkinex.exe") returned 0x18 [0330.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.129] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.129] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.129] IWbemClassObject:Get (in: This=0x58e05b8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392168*=0, plFlavor=0x239216c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ", varVal2=0x0), pType=0x2392168*=8, plFlavor=0x239216c*=0) returned 0x0 [0330.129] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0330.129] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0330.129] IWbemClassObject:Get (in: This=0x58e05b8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392168*=8, plFlavor=0x239216c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ", varVal2=0x0), pType=0x2392168*=8, plFlavor=0x239216c*=0) returned 0x0 [0330.129] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0330.129] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Office\\bitkinex.exe\" ") returned 0x62 [0330.130] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0330.130] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58e0750, puReturned=0x2377db0*=0x1) returned 0x0 [0330.196] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0750) returned 0x0 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.197] IUnknown:AddRef (This=0x58e0750) returned 0x3 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.197] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e0754) returned 0x0 [0330.197] IMarshal:GetUnmarshalClass (in: This=0x58e0754, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.197] IUnknown:Release (This=0x58e0754) returned 0x3 [0330.198] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.198] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.198] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.198] IUnknown:Release (This=0x58e0750) returned 0x2 [0330.198] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.198] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.198] IUnknown:QueryInterface (in: This=0x58e0750, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0750) returned 0x0 [0330.198] IUnknown:AddRef (This=0x58e0750) returned 0x4 [0330.198] IUnknown:Release (This=0x58e0750) returned 0x3 [0330.198] IUnknown:Release (This=0x58e0750) returned 0x2 [0330.198] CoTaskMemFree (pv=0x586b2e0) [0330.198] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.198] IUnknown:AddRef (This=0x58e0750) returned 0x3 [0330.199] IWbemClassObject:Get (in: This=0x58e0750, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.199] IWbemClassObject:Get (in: This=0x58e0750, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.199] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0330.199] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x5e [0330.199] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.199] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.200] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.200] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.201] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0330.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1bc0) returned 0x0 [0330.201] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0330.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1bc0) returned 0x0 [0330.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.202] WbemDefPath:IUnknown:AddRef (This=0x58f1bc0) returned 0x3 [0330.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5b68) returned 0x0 [0330.202] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5b68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.202] WbemDefPath:IUnknown:Release (This=0x58f5b68) returned 0x3 [0330.202] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.202] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.202] WbemDefPath:IUnknown:Release (This=0x58f1bc0) returned 0x2 [0330.203] WbemDefPath:IUnknown:Release (This=0x58f1bc0) returned 0x1 [0330.203] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.203] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1bc0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1bc0) returned 0x0 [0330.203] WbemDefPath:IUnknown:AddRef (This=0x58f1bc0) returned 0x3 [0330.203] WbemDefPath:IUnknown:Release (This=0x58f1bc0) returned 0x2 [0330.203] WbemDefPath:IWbemPath:SetText (This=0x58f1bc0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3620\"") returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.203] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.203] IWbemClassObject:Get (in: This=0x58e0750, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392cc0*=0, plFlavor=0x2392cc4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe24, varVal2=0x0), pType=0x2392cc0*=19, plFlavor=0x2392cc4*=0) returned 0x0 [0330.203] IWbemClassObject:Get (in: This=0x58e0750, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392cc0*=19, plFlavor=0x2392cc4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe24, varVal2=0x0), pType=0x2392cc0*=19, plFlavor=0x2392cc4*=0) returned 0x0 [0330.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.204] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.204] IWbemClassObject:Get (in: This=0x58e0750, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392dc4*=0, plFlavor=0x2392dc8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x2392dc4*=8, plFlavor=0x2392dc8*=0) returned 0x0 [0330.204] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0330.205] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0330.205] IWbemClassObject:Get (in: This=0x58e0750, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392dc4*=8, plFlavor=0x2392dc8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="coreftp.exe", varVal2=0x0), pType=0x2392dc4*=8, plFlavor=0x2392dc8*=0) returned 0x0 [0330.205] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0330.209] SysStringByteLen (bstr="coreftp.exe") returned 0x16 [0330.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.209] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.209] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.209] IWbemClassObject:Get (in: This=0x58e0750, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392f00*=0, plFlavor=0x2392f04*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ", varVal2=0x0), pType=0x2392f00*=8, plFlavor=0x2392f04*=0) returned 0x0 [0330.209] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0330.209] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0330.210] IWbemClassObject:Get (in: This=0x58e0750, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2392f00*=8, plFlavor=0x2392f04*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ", varVal2=0x0), pType=0x2392f00*=8, plFlavor=0x2392f04*=0) returned 0x0 [0330.210] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0330.210] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\coreftp.exe\" ") returned 0x6a [0330.210] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0330.210] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58dfdc0, puReturned=0x2377db0*=0x1) returned 0x0 [0330.213] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58dfdc0) returned 0x0 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.214] IUnknown:AddRef (This=0x58dfdc0) returned 0x3 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.214] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58dfdc4) returned 0x0 [0330.215] IMarshal:GetUnmarshalClass (in: This=0x58dfdc4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.215] IUnknown:Release (This=0x58dfdc4) returned 0x3 [0330.215] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.215] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.215] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.215] IUnknown:Release (This=0x58dfdc0) returned 0x2 [0330.215] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.215] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.215] IUnknown:QueryInterface (in: This=0x58dfdc0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58dfdc0) returned 0x0 [0330.215] IUnknown:AddRef (This=0x58dfdc0) returned 0x4 [0330.215] IUnknown:Release (This=0x58dfdc0) returned 0x3 [0330.215] IUnknown:Release (This=0x58dfdc0) returned 0x2 [0330.216] CoTaskMemFree (pv=0x586b2e0) [0330.216] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.216] IUnknown:AddRef (This=0x58dfdc0) returned 0x3 [0330.216] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.216] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.216] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0330.216] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x5e [0330.216] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.217] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.217] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.218] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.219] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1d80) returned 0x0 [0330.219] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1d80) returned 0x0 [0330.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.219] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.223] WbemDefPath:IUnknown:AddRef (This=0x58f1d80) returned 0x3 [0330.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.223] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5a90) returned 0x0 [0330.223] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5a90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.223] WbemDefPath:IUnknown:Release (This=0x58f5a90) returned 0x3 [0330.223] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.224] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.224] WbemDefPath:IUnknown:Release (This=0x58f1d80) returned 0x2 [0330.224] WbemDefPath:IUnknown:Release (This=0x58f1d80) returned 0x1 [0330.224] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.224] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1d80, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1d80) returned 0x0 [0330.224] WbemDefPath:IUnknown:AddRef (This=0x58f1d80) returned 0x3 [0330.224] WbemDefPath:IUnknown:Release (This=0x58f1d80) returned 0x2 [0330.224] WbemDefPath:IWbemPath:SetText (This=0x58f1d80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3636\"") returned 0x0 [0330.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.224] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.224] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.224] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.224] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.225] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.225] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393960*=0, plFlavor=0x2393964*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe34, varVal2=0x0), pType=0x2393960*=19, plFlavor=0x2393964*=0) returned 0x0 [0330.225] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393960*=19, plFlavor=0x2393964*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe34, varVal2=0x0), pType=0x2393960*=19, plFlavor=0x2393964*=0) returned 0x0 [0330.225] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.225] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.225] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.225] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393a64*=0, plFlavor=0x2393a68*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x2393a64*=8, plFlavor=0x2393a68*=0) returned 0x0 [0330.225] SysStringByteLen (bstr="far.exe") returned 0xe [0330.225] SysStringByteLen (bstr="far.exe") returned 0xe [0330.226] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393a64*=8, plFlavor=0x2393a68*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="far.exe", varVal2=0x0), pType=0x2393a64*=8, plFlavor=0x2393a68*=0) returned 0x0 [0330.226] SysStringByteLen (bstr="far.exe") returned 0xe [0330.226] SysStringByteLen (bstr="far.exe") returned 0xe [0330.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.226] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.226] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.226] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393b90*=0, plFlavor=0x2393b94*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ", varVal2=0x0), pType=0x2393b90*=8, plFlavor=0x2393b94*=0) returned 0x0 [0330.226] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0330.226] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0330.226] IWbemClassObject:Get (in: This=0x58dfdc0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2393b90*=8, plFlavor=0x2393b94*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ", varVal2=0x0), pType=0x2393b90*=8, plFlavor=0x2393b94*=0) returned 0x0 [0330.227] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0330.227] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft.NET\\far.exe\" ") returned 0x5e [0330.227] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0330.227] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58def68, puReturned=0x2377db0*=0x1) returned 0x0 [0330.289] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58def68) returned 0x0 [0330.289] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.289] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.289] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.290] IUnknown:AddRef (This=0x58def68) returned 0x3 [0330.290] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.290] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.290] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58def6c) returned 0x0 [0330.290] IMarshal:GetUnmarshalClass (in: This=0x58def6c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.290] IUnknown:Release (This=0x58def6c) returned 0x3 [0330.290] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.290] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.290] IUnknown:QueryInterface (in: This=0x58def68, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.291] IUnknown:Release (This=0x58def68) returned 0x2 [0330.291] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.291] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.291] IUnknown:QueryInterface (in: This=0x58def68, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58def68) returned 0x0 [0330.291] IUnknown:AddRef (This=0x58def68) returned 0x4 [0330.291] IUnknown:Release (This=0x58def68) returned 0x3 [0330.291] IUnknown:Release (This=0x58def68) returned 0x2 [0330.291] CoTaskMemFree (pv=0x586b340) [0330.291] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.291] IUnknown:AddRef (This=0x58def68) returned 0x3 [0330.291] IWbemClassObject:Get (in: This=0x58def68, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.291] IWbemClassObject:Get (in: This=0x58def68, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.292] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0330.292] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x5e [0330.292] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.292] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.292] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.292] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.293] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0330.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.293] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f21e0) returned 0x0 [0330.293] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f21e0) returned 0x0 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.294] WbemDefPath:IUnknown:AddRef (This=0x58f21e0) returned 0x3 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5f10) returned 0x0 [0330.294] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5f10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.294] WbemDefPath:IUnknown:Release (This=0x58f5f10) returned 0x3 [0330.294] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.294] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.295] WbemDefPath:IUnknown:Release (This=0x58f21e0) returned 0x2 [0330.295] WbemDefPath:IUnknown:Release (This=0x58f21e0) returned 0x1 [0330.295] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.295] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f21e0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f21e0) returned 0x0 [0330.295] WbemDefPath:IUnknown:AddRef (This=0x58f21e0) returned 0x3 [0330.295] WbemDefPath:IUnknown:Release (This=0x58f21e0) returned 0x2 [0330.295] WbemDefPath:IWbemPath:SetText (This=0x58f21e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3644\"") returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.295] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.295] IWbemClassObject:Get (in: This=0x58def68, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23945c4*=0, plFlavor=0x23945c8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe3c, varVal2=0x0), pType=0x23945c4*=19, plFlavor=0x23945c8*=0) returned 0x0 [0330.296] IWbemClassObject:Get (in: This=0x58def68, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23945c4*=19, plFlavor=0x23945c8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe3c, varVal2=0x0), pType=0x23945c4*=19, plFlavor=0x23945c8*=0) returned 0x0 [0330.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.296] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.296] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.315] IWbemClassObject:Get (in: This=0x58def68, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23946c8*=0, plFlavor=0x23946cc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x23946c8*=8, plFlavor=0x23946cc*=0) returned 0x0 [0330.315] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0330.315] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0330.316] IWbemClassObject:Get (in: This=0x58def68, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23946c8*=8, plFlavor=0x23946cc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="filezilla.exe", varVal2=0x0), pType=0x23946c8*=8, plFlavor=0x23946cc*=0) returned 0x0 [0330.316] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0330.316] SysStringByteLen (bstr="filezilla.exe") returned 0x1a [0330.316] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.316] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.316] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.316] IWbemClassObject:Get (in: This=0x58def68, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239480c*=0, plFlavor=0x2394810*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ", varVal2=0x0), pType=0x239480c*=8, plFlavor=0x2394810*=0) returned 0x0 [0330.316] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0330.316] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0330.316] IWbemClassObject:Get (in: This=0x58def68, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239480c*=8, plFlavor=0x2394810*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ", varVal2=0x0), pType=0x239480c*=8, plFlavor=0x2394810*=0) returned 0x0 [0330.317] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0330.317] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\filezilla.exe\" ") returned 0x6e [0330.317] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0330.317] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58dfa90, puReturned=0x2377db0*=0x1) returned 0x0 [0330.319] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58dfa90) returned 0x0 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.320] IUnknown:AddRef (This=0x58dfa90) returned 0x3 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.320] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58dfa94) returned 0x0 [0330.320] IMarshal:GetUnmarshalClass (in: This=0x58dfa94, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.320] IUnknown:Release (This=0x58dfa94) returned 0x3 [0330.321] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.321] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.321] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.321] IUnknown:Release (This=0x58dfa90) returned 0x2 [0330.321] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.321] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.321] IUnknown:QueryInterface (in: This=0x58dfa90, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58dfa90) returned 0x0 [0330.321] IUnknown:AddRef (This=0x58dfa90) returned 0x4 [0330.321] IUnknown:Release (This=0x58dfa90) returned 0x3 [0330.321] IUnknown:Release (This=0x58dfa90) returned 0x2 [0330.321] CoTaskMemFree (pv=0x586b460) [0330.321] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.321] IUnknown:AddRef (This=0x58dfa90) returned 0x3 [0330.321] IWbemClassObject:Get (in: This=0x58dfa90, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.322] IWbemClassObject:Get (in: This=0x58dfa90, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.323] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0330.323] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x5e [0330.323] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.323] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.323] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.323] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.324] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.325] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1df0) returned 0x0 [0330.325] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1df0) returned 0x0 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.325] WbemDefPath:IUnknown:AddRef (This=0x58f1df0) returned 0x3 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5fb8) returned 0x0 [0330.326] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5fb8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.326] WbemDefPath:IUnknown:Release (This=0x58f5fb8) returned 0x3 [0330.326] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.326] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.326] WbemDefPath:IUnknown:Release (This=0x58f1df0) returned 0x2 [0330.326] WbemDefPath:IUnknown:Release (This=0x58f1df0) returned 0x1 [0330.326] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.326] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1df0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1df0) returned 0x0 [0330.326] WbemDefPath:IUnknown:AddRef (This=0x58f1df0) returned 0x3 [0330.326] WbemDefPath:IUnknown:Release (This=0x58f1df0) returned 0x2 [0330.326] WbemDefPath:IWbemPath:SetText (This=0x58f1df0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3660\"") returned 0x0 [0330.326] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.327] IWbemClassObject:Get (in: This=0x58dfa90, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239527c*=0, plFlavor=0x2395280*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe4c, varVal2=0x0), pType=0x239527c*=19, plFlavor=0x2395280*=0) returned 0x0 [0330.327] IWbemClassObject:Get (in: This=0x58dfa90, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239527c*=19, plFlavor=0x2395280*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe4c, varVal2=0x0), pType=0x239527c*=19, plFlavor=0x2395280*=0) returned 0x0 [0330.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.328] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.328] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.328] IWbemClassObject:Get (in: This=0x58dfa90, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2395380*=0, plFlavor=0x2395384*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x2395380*=8, plFlavor=0x2395384*=0) returned 0x0 [0330.328] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0330.328] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0330.328] IWbemClassObject:Get (in: This=0x58dfa90, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2395380*=8, plFlavor=0x2395384*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="flashfxp.exe", varVal2=0x0), pType=0x2395380*=8, plFlavor=0x2395384*=0) returned 0x0 [0330.328] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0330.328] SysStringByteLen (bstr="flashfxp.exe") returned 0x18 [0330.332] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.332] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.332] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.332] IWbemClassObject:Get (in: This=0x58dfa90, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23954c4*=0, plFlavor=0x23954c8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ", varVal2=0x0), pType=0x23954c4*=8, plFlavor=0x23954c8*=0) returned 0x0 [0330.332] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0330.332] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0330.333] IWbemClassObject:Get (in: This=0x58dfa90, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23954c4*=8, plFlavor=0x23954c8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ", varVal2=0x0), pType=0x23954c4*=8, plFlavor=0x23954c8*=0) returned 0x0 [0330.333] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0330.333] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\flashfxp.exe\" ") returned 0x6a [0330.333] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0330.333] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58e08e8, puReturned=0x2377db0*=0x1) returned 0x0 [0330.335] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e08e8) returned 0x0 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.336] IUnknown:AddRef (This=0x58e08e8) returned 0x3 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.336] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e08ec) returned 0x0 [0330.337] IMarshal:GetUnmarshalClass (in: This=0x58e08ec, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.337] IUnknown:Release (This=0x58e08ec) returned 0x3 [0330.337] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.337] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.337] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.337] IUnknown:Release (This=0x58e08e8) returned 0x2 [0330.337] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.337] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.337] IUnknown:QueryInterface (in: This=0x58e08e8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e08e8) returned 0x0 [0330.337] IUnknown:AddRef (This=0x58e08e8) returned 0x4 [0330.337] IUnknown:Release (This=0x58e08e8) returned 0x3 [0330.337] IUnknown:Release (This=0x58e08e8) returned 0x2 [0330.337] CoTaskMemFree (pv=0x586b460) [0330.338] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.338] IUnknown:AddRef (This=0x58e08e8) returned 0x3 [0330.338] IWbemClassObject:Get (in: This=0x58e08e8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.338] IWbemClassObject:Get (in: This=0x58e08e8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.338] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0330.338] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x5e [0330.338] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.338] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.339] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.339] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.340] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0330.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.340] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2090) returned 0x0 [0330.340] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0330.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2090) returned 0x0 [0330.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.341] WbemDefPath:IUnknown:AddRef (This=0x58f2090) returned 0x3 [0330.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f61b0) returned 0x0 [0330.341] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f61b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.342] WbemDefPath:IUnknown:Release (This=0x58f61b0) returned 0x3 [0330.342] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.342] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.342] WbemDefPath:IUnknown:Release (This=0x58f2090) returned 0x2 [0330.342] WbemDefPath:IUnknown:Release (This=0x58f2090) returned 0x1 [0330.342] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.342] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2090, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2090) returned 0x0 [0330.342] WbemDefPath:IUnknown:AddRef (This=0x58f2090) returned 0x3 [0330.342] WbemDefPath:IUnknown:Release (This=0x58f2090) returned 0x2 [0330.342] WbemDefPath:IWbemPath:SetText (This=0x58f2090, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3672\"") returned 0x0 [0330.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.343] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.343] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.468] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.468] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.469] IWbemClassObject:Get (in: This=0x58e08e8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2395f28*=0, plFlavor=0x2395f2c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x2395f28*=19, plFlavor=0x2395f2c*=0) returned 0x0 [0330.469] IWbemClassObject:Get (in: This=0x58e08e8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2395f28*=19, plFlavor=0x2395f2c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe58, varVal2=0x0), pType=0x2395f28*=19, plFlavor=0x2395f2c*=0) returned 0x0 [0330.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.469] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.469] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.469] IWbemClassObject:Get (in: This=0x58e08e8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239602c*=0, plFlavor=0x2396030*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x239602c*=8, plFlavor=0x2396030*=0) returned 0x0 [0330.469] SysStringByteLen (bstr="fling.exe") returned 0x12 [0330.469] SysStringByteLen (bstr="fling.exe") returned 0x12 [0330.470] IWbemClassObject:Get (in: This=0x58e08e8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239602c*=8, plFlavor=0x2396030*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fling.exe", varVal2=0x0), pType=0x239602c*=8, plFlavor=0x2396030*=0) returned 0x0 [0330.470] SysStringByteLen (bstr="fling.exe") returned 0x12 [0330.470] SysStringByteLen (bstr="fling.exe") returned 0x12 [0330.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.470] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.470] IWbemClassObject:Get (in: This=0x58e08e8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396160*=0, plFlavor=0x2396164*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\fling.exe\" ", varVal2=0x0), pType=0x2396160*=8, plFlavor=0x2396164*=0) returned 0x0 [0330.470] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0330.470] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0330.471] IWbemClassObject:Get (in: This=0x58e08e8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396160*=8, plFlavor=0x2396164*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\fling.exe\" ", varVal2=0x0), pType=0x2396160*=8, plFlavor=0x2396164*=0) returned 0x0 [0330.471] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0330.471] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\fling.exe\" ") returned 0x44 [0330.471] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0330.471] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58e0db0, puReturned=0x2377db0*=0x1) returned 0x0 [0330.472] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58e0db0) returned 0x0 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.473] IUnknown:AddRef (This=0x58e0db0) returned 0x3 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.473] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58e0db4) returned 0x0 [0330.473] IMarshal:GetUnmarshalClass (in: This=0x58e0db4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.474] IUnknown:Release (This=0x58e0db4) returned 0x3 [0330.474] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.474] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.474] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.474] IUnknown:Release (This=0x58e0db0) returned 0x2 [0330.474] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.474] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.474] IUnknown:QueryInterface (in: This=0x58e0db0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58e0db0) returned 0x0 [0330.474] IUnknown:AddRef (This=0x58e0db0) returned 0x4 [0330.474] IUnknown:Release (This=0x58e0db0) returned 0x3 [0330.474] IUnknown:Release (This=0x58e0db0) returned 0x2 [0330.474] CoTaskMemFree (pv=0x586b2e0) [0330.474] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.474] IUnknown:AddRef (This=0x58e0db0) returned 0x3 [0330.474] IWbemClassObject:Get (in: This=0x58e0db0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.475] IWbemClassObject:Get (in: This=0x58e0db0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.475] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0330.475] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x5e [0330.475] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.475] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.475] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.475] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.477] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.477] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1990) returned 0x0 [0330.477] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1990) returned 0x0 [0330.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.478] WbemDefPath:IUnknown:AddRef (This=0x58f1990) returned 0x3 [0330.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f6180) returned 0x0 [0330.478] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f6180, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.478] WbemDefPath:IUnknown:Release (This=0x58f6180) returned 0x3 [0330.478] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.478] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.478] WbemDefPath:IUnknown:Release (This=0x58f1990) returned 0x2 [0330.478] WbemDefPath:IUnknown:Release (This=0x58f1990) returned 0x1 [0330.478] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.478] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1990, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1990) returned 0x0 [0330.479] WbemDefPath:IUnknown:AddRef (This=0x58f1990) returned 0x3 [0330.479] WbemDefPath:IUnknown:Release (This=0x58f1990) returned 0x2 [0330.479] WbemDefPath:IWbemPath:SetText (This=0x58f1990, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3680\"") returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.479] IWbemClassObject:Get (in: This=0x58e0db0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396b50*=0, plFlavor=0x2396b54*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x2396b50*=19, plFlavor=0x2396b54*=0) returned 0x0 [0330.479] IWbemClassObject:Get (in: This=0x58e0db0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396b50*=19, plFlavor=0x2396b54*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe60, varVal2=0x0), pType=0x2396b50*=19, plFlavor=0x2396b54*=0) returned 0x0 [0330.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.480] IWbemClassObject:Get (in: This=0x58e0db0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396c54*=0, plFlavor=0x2396c58*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2396c54*=8, plFlavor=0x2396c58*=0) returned 0x0 [0330.480] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0330.480] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0330.480] IWbemClassObject:Get (in: This=0x58e0db0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396c54*=8, plFlavor=0x2396c58*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="foxmailincmail.exe", varVal2=0x0), pType=0x2396c54*=8, plFlavor=0x2396c58*=0) returned 0x0 [0330.480] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0330.480] SysStringByteLen (bstr="foxmailincmail.exe") returned 0x24 [0330.480] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.480] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.481] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.481] IWbemClassObject:Get (in: This=0x58e0db0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396db0*=0, plFlavor=0x2396db4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x2396db0*=8, plFlavor=0x2396db4*=0) returned 0x0 [0330.481] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0330.481] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0330.481] IWbemClassObject:Get (in: This=0x58e0db0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2396db0*=8, plFlavor=0x2396db4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ", varVal2=0x0), pType=0x2396db0*=8, plFlavor=0x2396db4*=0) returned 0x0 [0330.481] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0330.481] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\foxmailincmail.exe\" ") returned 0x70 [0330.481] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0330.481] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58df8f8, puReturned=0x2377db0*=0x1) returned 0x0 [0330.483] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df8f8) returned 0x0 [0330.483] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0330.483] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0330.483] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0330.483] IUnknown:AddRef (This=0x58df8f8) returned 0x3 [0330.483] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0330.488] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0330.488] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df8fc) returned 0x0 [0330.488] IMarshal:GetUnmarshalClass (in: This=0x58df8fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0330.488] IUnknown:Release (This=0x58df8fc) returned 0x3 [0330.488] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0330.488] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0330.488] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0330.489] IUnknown:Release (This=0x58df8f8) returned 0x2 [0330.489] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0330.489] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0330.489] IUnknown:QueryInterface (in: This=0x58df8f8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df8f8) returned 0x0 [0330.489] IUnknown:AddRef (This=0x58df8f8) returned 0x4 [0330.489] IUnknown:Release (This=0x58df8f8) returned 0x3 [0330.489] IUnknown:Release (This=0x58df8f8) returned 0x2 [0330.489] CoTaskMemFree (pv=0x586b340) [0330.489] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0330.489] IUnknown:AddRef (This=0x58df8f8) returned 0x3 [0330.489] IWbemClassObject:Get (in: This=0x58df8f8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0330.489] IWbemClassObject:Get (in: This=0x58df8f8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0330.489] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0330.490] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x5e [0330.490] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0330.490] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0330.490] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0330.490] IUnknown:Release (This=0x692bc4) returned 0x1 [0330.491] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0330.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0330.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1e60) returned 0x0 [0330.491] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0330.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1e60) returned 0x0 [0330.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0330.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0330.493] WbemDefPath:IUnknown:AddRef (This=0x58f1e60) returned 0x3 [0330.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0330.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0330.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f64b0) returned 0x0 [0330.493] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f64b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0330.494] WbemDefPath:IUnknown:Release (This=0x58f64b0) returned 0x3 [0330.494] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0330.494] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0330.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0330.494] WbemDefPath:IUnknown:Release (This=0x58f1e60) returned 0x2 [0330.494] WbemDefPath:IUnknown:Release (This=0x58f1e60) returned 0x1 [0330.494] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0330.494] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0330.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1e60, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1e60) returned 0x0 [0330.494] WbemDefPath:IUnknown:AddRef (This=0x58f1e60) returned 0x3 [0330.494] WbemDefPath:IUnknown:Release (This=0x58f1e60) returned 0x2 [0330.494] WbemDefPath:IWbemPath:SetText (This=0x58f1e60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3696\"") returned 0x0 [0330.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0330.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0330.494] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.495] IWbemClassObject:Get (in: This=0x58df8f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397834*=0, plFlavor=0x2397838*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x2397834*=19, plFlavor=0x2397838*=0) returned 0x0 [0330.495] IWbemClassObject:Get (in: This=0x58df8f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397834*=19, plFlavor=0x2397838*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe70, varVal2=0x0), pType=0x2397834*=19, plFlavor=0x2397838*=0) returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.495] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.495] IWbemClassObject:Get (in: This=0x58df8f8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397938*=0, plFlavor=0x239793c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x2397938*=8, plFlavor=0x239793c*=0) returned 0x0 [0330.495] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0330.496] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0330.496] IWbemClassObject:Get (in: This=0x58df8f8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397938*=8, plFlavor=0x239793c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="gmailnotifierpro.exe", varVal2=0x0), pType=0x2397938*=8, plFlavor=0x239793c*=0) returned 0x0 [0330.496] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0330.496] SysStringByteLen (bstr="gmailnotifierpro.exe") returned 0x28 [0330.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0330.496] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0330.496] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0330.496] IWbemClassObject:Get (in: This=0x58df8f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397a9c*=0, plFlavor=0x2397aa0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x2397a9c*=8, plFlavor=0x2397aa0*=0) returned 0x0 [0330.496] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0330.496] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0330.497] IWbemClassObject:Get (in: This=0x58df8f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2397a9c*=8, plFlavor=0x2397aa0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ", varVal2=0x0), pType=0x2397a9c*=8, plFlavor=0x2397aa0*=0) returned 0x0 [0330.497] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0330.497] SysStringByteLen (bstr="\"C:\\Program Files\\Common Files\\gmailnotifierpro.exe\" ") returned 0x6a [0330.497] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0330.497] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58df5c8, puReturned=0x2377db0*=0x1) returned 0x0 [0331.542] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df5c8) returned 0x0 [0331.542] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.542] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.542] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.542] IUnknown:AddRef (This=0x58df5c8) returned 0x3 [0331.543] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.543] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.543] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df5cc) returned 0x0 [0331.543] IMarshal:GetUnmarshalClass (in: This=0x58df5cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.543] IUnknown:Release (This=0x58df5cc) returned 0x3 [0331.543] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.543] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.543] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.543] IUnknown:Release (This=0x58df5c8) returned 0x2 [0331.543] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.543] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.543] IUnknown:QueryInterface (in: This=0x58df5c8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df5c8) returned 0x0 [0331.543] IUnknown:AddRef (This=0x58df5c8) returned 0x4 [0331.544] IUnknown:Release (This=0x58df5c8) returned 0x3 [0331.544] IUnknown:Release (This=0x58df5c8) returned 0x2 [0331.544] CoTaskMemFree (pv=0x586b460) [0331.544] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.544] IUnknown:AddRef (This=0x58df5c8) returned 0x3 [0331.544] IWbemClassObject:Get (in: This=0x58df5c8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.544] IWbemClassObject:Get (in: This=0x58df5c8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.544] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0331.544] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x5e [0331.544] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.545] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.545] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.545] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.547] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.547] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1ed0) returned 0x0 [0331.547] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.547] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1ed0) returned 0x0 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.548] WbemDefPath:IUnknown:AddRef (This=0x58f1ed0) returned 0x3 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f6660) returned 0x0 [0331.548] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f6660, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.548] WbemDefPath:IUnknown:Release (This=0x58f6660) returned 0x3 [0331.548] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.548] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.548] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.549] WbemDefPath:IUnknown:Release (This=0x58f1ed0) returned 0x2 [0331.549] WbemDefPath:IUnknown:Release (This=0x58f1ed0) returned 0x1 [0331.549] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.549] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.549] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1ed0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1ed0) returned 0x0 [0331.549] WbemDefPath:IUnknown:AddRef (This=0x58f1ed0) returned 0x3 [0331.549] WbemDefPath:IUnknown:Release (This=0x58f1ed0) returned 0x2 [0331.549] WbemDefPath:IWbemPath:SetText (This=0x58f1ed0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3704\"") returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.549] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.549] IWbemClassObject:Get (in: This=0x58df5c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398510*=0, plFlavor=0x2398514*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x2398510*=19, plFlavor=0x2398514*=0) returned 0x0 [0331.550] IWbemClassObject:Get (in: This=0x58df5c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398510*=19, plFlavor=0x2398514*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe78, varVal2=0x0), pType=0x2398510*=19, plFlavor=0x2398514*=0) returned 0x0 [0331.550] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.550] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.550] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.550] IWbemClassObject:Get (in: This=0x58df5c8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398614*=0, plFlavor=0x2398618*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x2398614*=8, plFlavor=0x2398618*=0) returned 0x0 [0331.550] SysStringByteLen (bstr="icq.exe") returned 0xe [0331.550] SysStringByteLen (bstr="icq.exe") returned 0xe [0331.551] IWbemClassObject:Get (in: This=0x58df5c8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398614*=8, plFlavor=0x2398618*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="icq.exe", varVal2=0x0), pType=0x2398614*=8, plFlavor=0x2398618*=0) returned 0x0 [0331.551] SysStringByteLen (bstr="icq.exe") returned 0xe [0331.551] SysStringByteLen (bstr="icq.exe") returned 0xe [0331.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.551] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.551] IWbemClassObject:Get (in: This=0x58df5c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398740*=0, plFlavor=0x2398744*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ", varVal2=0x0), pType=0x2398740*=8, plFlavor=0x2398744*=0) returned 0x0 [0331.551] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0331.551] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0331.552] IWbemClassObject:Get (in: This=0x58df5c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2398740*=8, plFlavor=0x2398744*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ", varVal2=0x0), pType=0x2398740*=8, plFlavor=0x2398744*=0) returned 0x0 [0331.552] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0331.552] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Defender\\icq.exe\" ") returned 0x64 [0331.552] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.552] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58df760, puReturned=0x2377db0*=0x1) returned 0x0 [0331.572] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58df760) returned 0x0 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.573] IUnknown:AddRef (This=0x58df760) returned 0x3 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.573] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58df764) returned 0x0 [0331.573] IMarshal:GetUnmarshalClass (in: This=0x58df764, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.573] IUnknown:Release (This=0x58df764) returned 0x3 [0331.573] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.574] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.574] IUnknown:QueryInterface (in: This=0x58df760, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.574] IUnknown:Release (This=0x58df760) returned 0x2 [0331.574] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.574] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.574] IUnknown:QueryInterface (in: This=0x58df760, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58df760) returned 0x0 [0331.574] IUnknown:AddRef (This=0x58df760) returned 0x4 [0331.574] IUnknown:Release (This=0x58df760) returned 0x3 [0331.574] IUnknown:Release (This=0x58df760) returned 0x2 [0331.574] CoTaskMemFree (pv=0x586b460) [0331.574] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.574] IUnknown:AddRef (This=0x58df760) returned 0x3 [0331.574] IWbemClassObject:Get (in: This=0x58df760, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.575] IWbemClassObject:Get (in: This=0x58df760, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.575] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0331.575] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x5e [0331.575] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.575] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.575] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.575] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.576] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0331.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.577] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1f40) returned 0x0 [0331.577] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0331.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1f40) returned 0x0 [0331.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.577] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.577] WbemDefPath:IUnknown:AddRef (This=0x58f1f40) returned 0x3 [0331.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f27c0) returned 0x0 [0331.644] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f27c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.644] WbemDefPath:IUnknown:Release (This=0x58f27c0) returned 0x3 [0331.644] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.644] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.644] WbemDefPath:IUnknown:Release (This=0x58f1f40) returned 0x2 [0331.644] WbemDefPath:IUnknown:Release (This=0x58f1f40) returned 0x1 [0331.644] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.644] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.644] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1f40, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1f40) returned 0x0 [0331.644] WbemDefPath:IUnknown:AddRef (This=0x58f1f40) returned 0x3 [0331.644] WbemDefPath:IUnknown:Release (This=0x58f1f40) returned 0x2 [0331.644] WbemDefPath:IWbemPath:SetText (This=0x58f1f40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3720\"") returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.645] IWbemClassObject:Get (in: This=0x58df760, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239918c*=0, plFlavor=0x2399190*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe88, varVal2=0x0), pType=0x239918c*=19, plFlavor=0x2399190*=0) returned 0x0 [0331.645] IWbemClassObject:Get (in: This=0x58df760, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239918c*=19, plFlavor=0x2399190*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe88, varVal2=0x0), pType=0x239918c*=19, plFlavor=0x2399190*=0) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.645] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.646] IWbemClassObject:Get (in: This=0x58df760, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399290*=0, plFlavor=0x2399294*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x2399290*=8, plFlavor=0x2399294*=0) returned 0x0 [0331.646] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0331.646] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0331.646] IWbemClassObject:Get (in: This=0x58df760, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399290*=8, plFlavor=0x2399294*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="leechftp.exe", varVal2=0x0), pType=0x2399290*=8, plFlavor=0x2399294*=0) returned 0x0 [0331.646] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0331.646] SysStringByteLen (bstr="leechftp.exe") returned 0x18 [0331.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.646] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.646] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.646] IWbemClassObject:Get (in: This=0x58df760, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23993d4*=0, plFlavor=0x23993d8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ", varVal2=0x0), pType=0x23993d4*=8, plFlavor=0x23993d8*=0) returned 0x0 [0331.646] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0331.647] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0331.647] IWbemClassObject:Get (in: This=0x58df760, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23993d4*=8, plFlavor=0x23993d8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ", varVal2=0x0), pType=0x23993d4*=8, plFlavor=0x23993d8*=0) returned 0x0 [0331.647] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0331.647] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\leechftp.exe\" ") returned 0x6a [0331.647] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.647] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fdd60, puReturned=0x2377db0*=0x1) returned 0x0 [0331.649] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fdd60) returned 0x0 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.650] IUnknown:AddRef (This=0x58fdd60) returned 0x3 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.650] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fdd64) returned 0x0 [0331.650] IMarshal:GetUnmarshalClass (in: This=0x58fdd64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.651] IUnknown:Release (This=0x58fdd64) returned 0x3 [0331.651] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.651] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.651] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.651] IUnknown:Release (This=0x58fdd60) returned 0x2 [0331.651] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.651] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.651] IUnknown:QueryInterface (in: This=0x58fdd60, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fdd60) returned 0x0 [0331.651] IUnknown:AddRef (This=0x58fdd60) returned 0x4 [0331.651] IUnknown:Release (This=0x58fdd60) returned 0x3 [0331.651] IUnknown:Release (This=0x58fdd60) returned 0x2 [0331.651] CoTaskMemFree (pv=0x586b460) [0331.651] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.651] IUnknown:AddRef (This=0x58fdd60) returned 0x3 [0331.652] IWbemClassObject:Get (in: This=0x58fdd60, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.652] IWbemClassObject:Get (in: This=0x58fdd60, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.652] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0331.652] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x5e [0331.652] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.652] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.653] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.653] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.654] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.654] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f23a0) returned 0x0 [0331.654] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f23a0) returned 0x0 [0331.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.654] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.655] WbemDefPath:IUnknown:AddRef (This=0x58f23a0) returned 0x3 [0331.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f2c70) returned 0x0 [0331.655] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f2c70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.655] WbemDefPath:IUnknown:Release (This=0x58f2c70) returned 0x3 [0331.655] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.655] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.655] WbemDefPath:IUnknown:Release (This=0x58f23a0) returned 0x2 [0331.655] WbemDefPath:IUnknown:Release (This=0x58f23a0) returned 0x1 [0331.655] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.655] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.655] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f23a0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f23a0) returned 0x0 [0331.656] WbemDefPath:IUnknown:AddRef (This=0x58f23a0) returned 0x3 [0331.656] WbemDefPath:IUnknown:Release (This=0x58f23a0) returned 0x2 [0331.656] WbemDefPath:IWbemPath:SetText (This=0x58f23a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3732\"") returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.656] IWbemClassObject:Get (in: This=0x58fdd60, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399e38*=0, plFlavor=0x2399e3c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe94, varVal2=0x0), pType=0x2399e38*=19, plFlavor=0x2399e3c*=0) returned 0x0 [0331.656] IWbemClassObject:Get (in: This=0x58fdd60, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399e38*=19, plFlavor=0x2399e3c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe94, varVal2=0x0), pType=0x2399e38*=19, plFlavor=0x2399e3c*=0) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.656] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.657] IWbemClassObject:Get (in: This=0x58fdd60, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399f3c*=0, plFlavor=0x2399f40*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x2399f3c*=8, plFlavor=0x2399f40*=0) returned 0x0 [0331.657] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0331.657] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0331.657] IWbemClassObject:Get (in: This=0x58fdd60, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2399f3c*=8, plFlavor=0x2399f40*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ncftp.exe", varVal2=0x0), pType=0x2399f3c*=8, plFlavor=0x2399f40*=0) returned 0x0 [0331.657] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0331.657] SysStringByteLen (bstr="ncftp.exe") returned 0x12 [0331.657] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.657] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.657] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.657] IWbemClassObject:Get (in: This=0x58fdd60, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239a070*=0, plFlavor=0x239a074*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x239a070*=8, plFlavor=0x239a074*=0) returned 0x0 [0331.657] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0331.657] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0331.658] IWbemClassObject:Get (in: This=0x58fdd60, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239a070*=8, plFlavor=0x239a074*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ", varVal2=0x0), pType=0x239a070*=8, plFlavor=0x239a074*=0) returned 0x0 [0331.658] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0331.658] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\ncftp.exe\" ") returned 0x64 [0331.658] CoTaskMemAlloc (cb=0x4) returned 0x586b360 [0331.658] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b360, puReturned=0x2377db0 | out: apObjects=0x586b360*=0x58fd898, puReturned=0x2377db0*=0x1) returned 0x0 [0331.661] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd898) returned 0x0 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.662] IUnknown:AddRef (This=0x58fd898) returned 0x3 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd89c) returned 0x0 [0331.662] IMarshal:GetUnmarshalClass (in: This=0x58fd89c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.662] IUnknown:Release (This=0x58fd89c) returned 0x3 [0331.662] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.662] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.662] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.663] IUnknown:Release (This=0x58fd898) returned 0x2 [0331.663] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.663] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.663] IUnknown:QueryInterface (in: This=0x58fd898, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd898) returned 0x0 [0331.663] IUnknown:AddRef (This=0x58fd898) returned 0x4 [0331.663] IUnknown:Release (This=0x58fd898) returned 0x3 [0331.663] IUnknown:Release (This=0x58fd898) returned 0x2 [0331.663] CoTaskMemFree (pv=0x586b360) [0331.663] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.663] IUnknown:AddRef (This=0x58fd898) returned 0x3 [0331.663] IWbemClassObject:Get (in: This=0x58fd898, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.663] IWbemClassObject:Get (in: This=0x58fd898, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.664] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0331.664] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x5e [0331.665] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.665] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.665] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.665] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.666] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.666] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.666] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2480) returned 0x0 [0331.667] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2480) returned 0x0 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.667] WbemDefPath:IUnknown:AddRef (This=0x58f2480) returned 0x3 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f2d00) returned 0x0 [0331.667] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f2d00, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.667] WbemDefPath:IUnknown:Release (This=0x58f2d00) returned 0x3 [0331.667] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.668] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.668] WbemDefPath:IUnknown:Release (This=0x58f2480) returned 0x2 [0331.668] WbemDefPath:IUnknown:Release (This=0x58f2480) returned 0x1 [0331.668] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.668] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2480, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2480) returned 0x0 [0331.668] WbemDefPath:IUnknown:AddRef (This=0x58f2480) returned 0x3 [0331.668] WbemDefPath:IUnknown:Release (This=0x58f2480) returned 0x2 [0331.668] WbemDefPath:IWbemPath:SetText (This=0x58f2480, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3740\"") returned 0x0 [0331.668] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.668] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.668] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.669] IWbemClassObject:Get (in: This=0x58fd898, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239aac0*=0, plFlavor=0x239aac4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe9c, varVal2=0x0), pType=0x239aac0*=19, plFlavor=0x239aac4*=0) returned 0x0 [0331.669] IWbemClassObject:Get (in: This=0x58fd898, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239aac0*=19, plFlavor=0x239aac4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe9c, varVal2=0x0), pType=0x239aac0*=19, plFlavor=0x239aac4*=0) returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.669] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.669] IWbemClassObject:Get (in: This=0x58fd898, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239abc4*=0, plFlavor=0x239abc8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x239abc4*=8, plFlavor=0x239abc8*=0) returned 0x0 [0331.670] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0331.670] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0331.670] IWbemClassObject:Get (in: This=0x58fd898, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239abc4*=8, plFlavor=0x239abc8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="notepad.exe", varVal2=0x0), pType=0x239abc4*=8, plFlavor=0x239abc8*=0) returned 0x0 [0331.670] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0331.670] SysStringByteLen (bstr="notepad.exe") returned 0x16 [0331.670] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.670] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.670] IWbemClassObject:Get (in: This=0x58fd898, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ad00*=0, plFlavor=0x239ad04*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ", varVal2=0x0), pType=0x239ad00*=8, plFlavor=0x239ad04*=0) returned 0x0 [0331.670] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0331.670] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0331.671] IWbemClassObject:Get (in: This=0x58fd898, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ad00*=8, plFlavor=0x239ad04*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ", varVal2=0x0), pType=0x239ad00*=8, plFlavor=0x239ad04*=0) returned 0x0 [0331.671] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0331.671] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Media Player\\notepad.exe\" ") returned 0x74 [0331.731] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0331.731] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58fe228, puReturned=0x2377db0*=0x1) returned 0x0 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fe228) returned 0x0 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.733] IUnknown:AddRef (This=0x58fe228) returned 0x3 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.733] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.734] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fe22c) returned 0x0 [0331.735] IMarshal:GetUnmarshalClass (in: This=0x58fe22c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.735] IUnknown:Release (This=0x58fe22c) returned 0x3 [0331.735] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.735] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.735] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.735] IUnknown:Release (This=0x58fe228) returned 0x2 [0331.735] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.735] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.735] IUnknown:QueryInterface (in: This=0x58fe228, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fe228) returned 0x0 [0331.735] IUnknown:AddRef (This=0x58fe228) returned 0x4 [0331.735] IUnknown:Release (This=0x58fe228) returned 0x3 [0331.735] IUnknown:Release (This=0x58fe228) returned 0x2 [0331.735] CoTaskMemFree (pv=0x586b340) [0331.735] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.735] IUnknown:AddRef (This=0x58fe228) returned 0x3 [0331.736] IWbemClassObject:Get (in: This=0x58fe228, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.736] IWbemClassObject:Get (in: This=0x58fe228, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0331.736] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x5e [0331.736] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.736] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.736] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.736] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.738] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.738] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f1760) returned 0x0 [0331.738] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f1760) returned 0x0 [0331.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.738] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.738] WbemDefPath:IUnknown:AddRef (This=0x58f1760) returned 0x3 [0331.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f2ec8) returned 0x0 [0331.739] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f2ec8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.739] WbemDefPath:IUnknown:Release (This=0x58f2ec8) returned 0x3 [0331.739] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.739] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.739] WbemDefPath:IUnknown:Release (This=0x58f1760) returned 0x2 [0331.739] WbemDefPath:IUnknown:Release (This=0x58f1760) returned 0x1 [0331.739] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.739] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.739] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f1760, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f1760) returned 0x0 [0331.739] WbemDefPath:IUnknown:AddRef (This=0x58f1760) returned 0x3 [0331.739] WbemDefPath:IUnknown:Release (This=0x58f1760) returned 0x2 [0331.739] WbemDefPath:IWbemPath:SetText (This=0x58f1760, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3756\"") returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.740] IWbemClassObject:Get (in: This=0x58fe228, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b784*=0, plFlavor=0x239b788*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x239b784*=19, plFlavor=0x239b788*=0) returned 0x0 [0331.740] IWbemClassObject:Get (in: This=0x58fe228, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b784*=19, plFlavor=0x239b788*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeac, varVal2=0x0), pType=0x239b784*=19, plFlavor=0x239b788*=0) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.740] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.741] IWbemClassObject:Get (in: This=0x58fe228, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b888*=0, plFlavor=0x239b88c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x239b888*=8, plFlavor=0x239b88c*=0) returned 0x0 [0331.741] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0331.741] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0331.741] IWbemClassObject:Get (in: This=0x58fe228, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b888*=8, plFlavor=0x239b88c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="operamail.exe", varVal2=0x0), pType=0x239b888*=8, plFlavor=0x239b88c*=0) returned 0x0 [0331.741] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0331.741] SysStringByteLen (bstr="operamail.exe") returned 0x1a [0331.741] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.741] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.741] IWbemClassObject:Get (in: This=0x58fe228, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b9cc*=0, plFlavor=0x239b9d0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ", varVal2=0x0), pType=0x239b9cc*=8, plFlavor=0x239b9d0*=0) returned 0x0 [0331.741] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0331.741] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0331.742] IWbemClassObject:Get (in: This=0x58fe228, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239b9cc*=8, plFlavor=0x239b9d0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ", varVal2=0x0), pType=0x239b9cc*=8, plFlavor=0x239b9d0*=0) returned 0x0 [0331.742] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0331.742] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\operamail.exe\" ") returned 0x64 [0331.742] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.742] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fcf08, puReturned=0x2377db0*=0x1) returned 0x0 [0331.744] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fcf08) returned 0x0 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.745] IUnknown:AddRef (This=0x58fcf08) returned 0x3 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fcf0c) returned 0x0 [0331.745] IMarshal:GetUnmarshalClass (in: This=0x58fcf0c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.745] IUnknown:Release (This=0x58fcf0c) returned 0x3 [0331.745] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.745] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.745] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.746] IUnknown:Release (This=0x58fcf08) returned 0x2 [0331.746] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.746] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.746] IUnknown:QueryInterface (in: This=0x58fcf08, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fcf08) returned 0x0 [0331.746] IUnknown:AddRef (This=0x58fcf08) returned 0x4 [0331.746] IUnknown:Release (This=0x58fcf08) returned 0x3 [0331.746] IUnknown:Release (This=0x58fcf08) returned 0x2 [0331.746] CoTaskMemFree (pv=0x586b460) [0331.746] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.746] IUnknown:AddRef (This=0x58fcf08) returned 0x3 [0331.746] IWbemClassObject:Get (in: This=0x58fcf08, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.746] IWbemClassObject:Get (in: This=0x58fcf08, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.747] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0331.747] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x5e [0331.747] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.747] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.747] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.747] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.748] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.748] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f17d0) returned 0x0 [0331.748] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.748] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f17d0) returned 0x0 [0331.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.749] WbemDefPath:IUnknown:AddRef (This=0x58f17d0) returned 0x3 [0331.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.749] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f2d60) returned 0x0 [0331.749] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f2d60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.749] WbemDefPath:IUnknown:Release (This=0x58f2d60) returned 0x3 [0331.749] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.750] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.750] WbemDefPath:IUnknown:Release (This=0x58f17d0) returned 0x2 [0331.750] WbemDefPath:IUnknown:Release (This=0x58f17d0) returned 0x1 [0331.750] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.750] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.750] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f17d0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f17d0) returned 0x0 [0331.750] WbemDefPath:IUnknown:AddRef (This=0x58f17d0) returned 0x3 [0331.750] WbemDefPath:IUnknown:Release (This=0x58f17d0) returned 0x2 [0331.750] WbemDefPath:IWbemPath:SetText (This=0x58f17d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3764\"") returned 0x0 [0331.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.750] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.750] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.750] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.750] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.751] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.751] IWbemClassObject:Get (in: This=0x58fcf08, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c424*=0, plFlavor=0x239c428*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeb4, varVal2=0x0), pType=0x239c424*=19, plFlavor=0x239c428*=0) returned 0x0 [0331.751] IWbemClassObject:Get (in: This=0x58fcf08, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c424*=19, plFlavor=0x239c428*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xeb4, varVal2=0x0), pType=0x239c424*=19, plFlavor=0x239c428*=0) returned 0x0 [0331.751] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.751] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.751] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.751] IWbemClassObject:Get (in: This=0x58fcf08, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c528*=0, plFlavor=0x239c52c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x239c528*=8, plFlavor=0x239c52c*=0) returned 0x0 [0331.751] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0331.752] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0331.752] IWbemClassObject:Get (in: This=0x58fcf08, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c528*=8, plFlavor=0x239c52c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="outlook.exe", varVal2=0x0), pType=0x239c528*=8, plFlavor=0x239c52c*=0) returned 0x0 [0331.752] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0331.752] SysStringByteLen (bstr="outlook.exe") returned 0x16 [0331.752] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.752] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.752] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.752] IWbemClassObject:Get (in: This=0x58fcf08, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c664*=0, plFlavor=0x239c668*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x239c664*=8, plFlavor=0x239c668*=0) returned 0x0 [0331.752] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0331.752] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0331.753] IWbemClassObject:Get (in: This=0x58fcf08, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239c664*=8, plFlavor=0x239c668*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ", varVal2=0x0), pType=0x239c664*=8, plFlavor=0x239c668*=0) returned 0x0 [0331.753] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0331.753] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Journal\\outlook.exe\" ") returned 0x5e [0331.753] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.753] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fca40, puReturned=0x2377db0*=0x1) returned 0x0 [0331.755] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fca40) returned 0x0 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.756] IUnknown:AddRef (This=0x58fca40) returned 0x3 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fca44) returned 0x0 [0331.756] IMarshal:GetUnmarshalClass (in: This=0x58fca44, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.756] IUnknown:Release (This=0x58fca44) returned 0x3 [0331.756] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.756] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.756] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.756] IUnknown:Release (This=0x58fca40) returned 0x2 [0331.756] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.756] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.757] IUnknown:QueryInterface (in: This=0x58fca40, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fca40) returned 0x0 [0331.757] IUnknown:AddRef (This=0x58fca40) returned 0x4 [0331.757] IUnknown:Release (This=0x58fca40) returned 0x3 [0331.757] IUnknown:Release (This=0x58fca40) returned 0x2 [0331.757] CoTaskMemFree (pv=0x586b460) [0331.757] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.757] IUnknown:AddRef (This=0x58fca40) returned 0x3 [0331.757] IWbemClassObject:Get (in: This=0x58fca40, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.757] IWbemClassObject:Get (in: This=0x58fca40, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.758] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0331.758] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x5e [0331.758] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.758] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.758] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.758] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.759] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0331.759] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.759] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f24f0) returned 0x0 [0331.760] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f24f0) returned 0x0 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.760] WbemDefPath:IUnknown:AddRef (This=0x58f24f0) returned 0x3 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3210) returned 0x0 [0331.760] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3210, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.760] WbemDefPath:IUnknown:Release (This=0x58f3210) returned 0x3 [0331.760] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.760] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.761] WbemDefPath:IUnknown:Release (This=0x58f24f0) returned 0x2 [0331.761] WbemDefPath:IUnknown:Release (This=0x58f24f0) returned 0x1 [0331.761] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.761] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f24f0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f24f0) returned 0x0 [0331.761] WbemDefPath:IUnknown:AddRef (This=0x58f24f0) returned 0x3 [0331.761] WbemDefPath:IUnknown:Release (This=0x58f24f0) returned 0x2 [0331.761] WbemDefPath:IWbemPath:SetText (This=0x58f24f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3776\"") returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.761] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.761] IWbemClassObject:Get (in: This=0x58fca40, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d0a0*=0, plFlavor=0x239d0a4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec0, varVal2=0x0), pType=0x239d0a0*=19, plFlavor=0x239d0a4*=0) returned 0x0 [0331.762] IWbemClassObject:Get (in: This=0x58fca40, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d0a0*=19, plFlavor=0x239d0a4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xec0, varVal2=0x0), pType=0x239d0a0*=19, plFlavor=0x239d0a4*=0) returned 0x0 [0331.762] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.762] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.762] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.762] IWbemClassObject:Get (in: This=0x58fca40, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d1a4*=0, plFlavor=0x239d1a8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x239d1a4*=8, plFlavor=0x239d1a8*=0) returned 0x0 [0331.762] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0331.762] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0331.762] IWbemClassObject:Get (in: This=0x58fca40, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d1a4*=8, plFlavor=0x239d1a8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="pidgin.exe", varVal2=0x0), pType=0x239d1a4*=8, plFlavor=0x239d1a8*=0) returned 0x0 [0331.762] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0331.762] SysStringByteLen (bstr="pidgin.exe") returned 0x14 [0331.762] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.762] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.762] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.763] IWbemClassObject:Get (in: This=0x58fca40, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d2e0*=0, plFlavor=0x239d2e4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ", varVal2=0x0), pType=0x239d2e0*=8, plFlavor=0x239d2e4*=0) returned 0x0 [0331.763] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0331.763] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0331.763] IWbemClassObject:Get (in: This=0x58fca40, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239d2e0*=8, plFlavor=0x239d2e4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ", varVal2=0x0), pType=0x239d2e0*=8, plFlavor=0x239d2e4*=0) returned 0x0 [0331.763] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0331.763] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Photo Viewer\\pidgin.exe\" ") returned 0x72 [0331.763] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0331.763] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58fda30, puReturned=0x2377db0*=0x1) returned 0x0 [0331.766] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fda30) returned 0x0 [0331.766] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.766] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.766] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.767] IUnknown:AddRef (This=0x58fda30) returned 0x3 [0331.767] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.767] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.767] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fda34) returned 0x0 [0331.767] IMarshal:GetUnmarshalClass (in: This=0x58fda34, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.767] IUnknown:Release (This=0x58fda34) returned 0x3 [0331.767] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.767] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.767] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.767] IUnknown:Release (This=0x58fda30) returned 0x2 [0331.767] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.767] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.767] IUnknown:QueryInterface (in: This=0x58fda30, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fda30) returned 0x0 [0331.767] IUnknown:AddRef (This=0x58fda30) returned 0x4 [0331.768] IUnknown:Release (This=0x58fda30) returned 0x3 [0331.768] IUnknown:Release (This=0x58fda30) returned 0x2 [0331.768] CoTaskMemFree (pv=0x586b340) [0331.768] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.768] IUnknown:AddRef (This=0x58fda30) returned 0x3 [0331.768] IWbemClassObject:Get (in: This=0x58fda30, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.768] IWbemClassObject:Get (in: This=0x58fda30, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.768] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0331.768] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x5e [0331.768] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.769] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.769] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.769] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.770] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.770] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2640) returned 0x0 [0331.770] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2640) returned 0x0 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.770] WbemDefPath:IUnknown:AddRef (This=0x58f2640) returned 0x3 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3240) returned 0x0 [0331.771] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3240, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.771] WbemDefPath:IUnknown:Release (This=0x58f3240) returned 0x3 [0331.771] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.771] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.771] WbemDefPath:IUnknown:Release (This=0x58f2640) returned 0x2 [0331.771] WbemDefPath:IUnknown:Release (This=0x58f2640) returned 0x1 [0331.771] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.771] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.771] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2640, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2640) returned 0x0 [0331.771] WbemDefPath:IUnknown:AddRef (This=0x58f2640) returned 0x3 [0331.771] WbemDefPath:IUnknown:Release (This=0x58f2640) returned 0x2 [0331.771] WbemDefPath:IWbemPath:SetText (This=0x58f2640, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3796\"") returned 0x0 [0331.771] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.771] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.771] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.772] IWbemClassObject:Get (in: This=0x58fda30, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239dd58*=0, plFlavor=0x239dd5c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x239dd58*=19, plFlavor=0x239dd5c*=0) returned 0x0 [0331.772] IWbemClassObject:Get (in: This=0x58fda30, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239dd58*=19, plFlavor=0x239dd5c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xed4, varVal2=0x0), pType=0x239dd58*=19, plFlavor=0x239dd5c*=0) returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.772] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.772] IWbemClassObject:Get (in: This=0x58fda30, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239de5c*=0, plFlavor=0x239de60*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x239de5c*=8, plFlavor=0x239de60*=0) returned 0x0 [0331.772] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0331.772] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0331.773] IWbemClassObject:Get (in: This=0x58fda30, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239de5c*=8, plFlavor=0x239de60*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="scriptftp.exe", varVal2=0x0), pType=0x239de5c*=8, plFlavor=0x239de60*=0) returned 0x0 [0331.773] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0331.773] SysStringByteLen (bstr="scriptftp.exe") returned 0x1a [0331.773] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.773] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.773] IWbemClassObject:Get (in: This=0x58fda30, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239dfa0*=0, plFlavor=0x239dfa4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ", varVal2=0x0), pType=0x239dfa0*=8, plFlavor=0x239dfa4*=0) returned 0x0 [0331.773] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0331.773] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0331.773] IWbemClassObject:Get (in: This=0x58fda30, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239dfa0*=8, plFlavor=0x239dfa4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ", varVal2=0x0), pType=0x239dfa0*=8, plFlavor=0x239dfa4*=0) returned 0x0 [0331.774] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0331.774] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Multimedia Platform\\scriptftp.exe\" ") returned 0x86 [0331.774] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.774] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fd238, puReturned=0x2377db0*=0x1) returned 0x0 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd238) returned 0x0 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.825] IUnknown:AddRef (This=0x58fd238) returned 0x3 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.825] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd23c) returned 0x0 [0331.826] IMarshal:GetUnmarshalClass (in: This=0x58fd23c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.826] IUnknown:Release (This=0x58fd23c) returned 0x3 [0331.826] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.826] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.826] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.826] IUnknown:Release (This=0x58fd238) returned 0x2 [0331.826] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.826] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.826] IUnknown:QueryInterface (in: This=0x58fd238, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd238) returned 0x0 [0331.826] IUnknown:AddRef (This=0x58fd238) returned 0x4 [0331.826] IUnknown:Release (This=0x58fd238) returned 0x3 [0331.826] IUnknown:Release (This=0x58fd238) returned 0x2 [0331.826] CoTaskMemFree (pv=0x586b460) [0331.826] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.826] IUnknown:AddRef (This=0x58fd238) returned 0x3 [0331.826] IWbemClassObject:Get (in: This=0x58fd238, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.827] IWbemClassObject:Get (in: This=0x58fd238, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.827] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0331.827] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x5e [0331.827] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.827] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.828] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.828] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.829] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0331.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.829] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f2560) returned 0x0 [0331.829] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0331.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f2560) returned 0x0 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.830] WbemDefPath:IUnknown:AddRef (This=0x58f2560) returned 0x3 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3420) returned 0x0 [0331.830] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3420, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.830] WbemDefPath:IUnknown:Release (This=0x58f3420) returned 0x3 [0331.830] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.830] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.830] WbemDefPath:IUnknown:Release (This=0x58f2560) returned 0x2 [0331.830] WbemDefPath:IUnknown:Release (This=0x58f2560) returned 0x1 [0331.831] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.831] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.831] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f2560, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f2560) returned 0x0 [0331.831] WbemDefPath:IUnknown:AddRef (This=0x58f2560) returned 0x3 [0331.831] WbemDefPath:IUnknown:Release (This=0x58f2560) returned 0x2 [0331.831] WbemDefPath:IWbemPath:SetText (This=0x58f2560, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3804\"") returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.831] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.831] IWbemClassObject:Get (in: This=0x58fd238, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ea58*=0, plFlavor=0x239ea5c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x239ea58*=19, plFlavor=0x239ea5c*=0) returned 0x0 [0331.831] IWbemClassObject:Get (in: This=0x58fd238, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ea58*=19, plFlavor=0x239ea5c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xedc, varVal2=0x0), pType=0x239ea58*=19, plFlavor=0x239ea5c*=0) returned 0x0 [0331.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.832] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.832] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.832] IWbemClassObject:Get (in: This=0x58fd238, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239eb5c*=0, plFlavor=0x239eb60*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x239eb5c*=8, plFlavor=0x239eb60*=0) returned 0x0 [0331.832] SysStringByteLen (bstr="skype.exe") returned 0x12 [0331.832] SysStringByteLen (bstr="skype.exe") returned 0x12 [0331.832] IWbemClassObject:Get (in: This=0x58fd238, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239eb5c*=8, plFlavor=0x239eb60*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="skype.exe", varVal2=0x0), pType=0x239eb5c*=8, plFlavor=0x239eb60*=0) returned 0x0 [0331.832] SysStringByteLen (bstr="skype.exe") returned 0x12 [0331.832] SysStringByteLen (bstr="skype.exe") returned 0x12 [0331.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.832] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.832] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.833] IWbemClassObject:Get (in: This=0x58fd238, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ec90*=0, plFlavor=0x239ec94*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ", varVal2=0x0), pType=0x239ec90*=8, plFlavor=0x239ec94*=0) returned 0x0 [0331.833] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0331.833] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0331.833] IWbemClassObject:Get (in: This=0x58fd238, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239ec90*=8, plFlavor=0x239ec94*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ", varVal2=0x0), pType=0x239ec90*=8, plFlavor=0x239ec94*=0) returned 0x0 [0331.833] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0331.833] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\skype.exe\" ") returned 0x64 [0331.833] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0331.833] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58fe3c0, puReturned=0x2377db0*=0x1) returned 0x0 [0331.834] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fe3c0) returned 0x0 [0331.834] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.835] IUnknown:AddRef (This=0x58fe3c0) returned 0x3 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fe3c4) returned 0x0 [0331.835] IMarshal:GetUnmarshalClass (in: This=0x58fe3c4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.835] IUnknown:Release (This=0x58fe3c4) returned 0x3 [0331.835] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.835] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.835] IUnknown:Release (This=0x58fe3c0) returned 0x2 [0331.835] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.835] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.835] IUnknown:QueryInterface (in: This=0x58fe3c0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fe3c0) returned 0x0 [0331.835] IUnknown:AddRef (This=0x58fe3c0) returned 0x4 [0331.835] IUnknown:Release (This=0x58fe3c0) returned 0x3 [0331.836] IUnknown:Release (This=0x58fe3c0) returned 0x2 [0331.836] CoTaskMemFree (pv=0x586b340) [0331.836] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.836] IUnknown:AddRef (This=0x58fe3c0) returned 0x3 [0331.836] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.836] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.836] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0331.836] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x5e [0331.836] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.836] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.836] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.836] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.837] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b360) returned 0x0 [0331.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.837] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x58f25d0) returned 0x0 [0331.838] WbemDefPath:IUnknown:Release (This=0x586b360) returned 0x0 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x58f25d0) returned 0x0 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.838] WbemDefPath:IUnknown:AddRef (This=0x58f25d0) returned 0x3 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3858) returned 0x0 [0331.838] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3858, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.838] WbemDefPath:IUnknown:Release (This=0x58f3858) returned 0x3 [0331.838] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.838] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.839] WbemDefPath:IUnknown:Release (This=0x58f25d0) returned 0x2 [0331.839] WbemDefPath:IUnknown:Release (This=0x58f25d0) returned 0x1 [0331.839] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.839] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x58f25d0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x58f25d0) returned 0x0 [0331.839] WbemDefPath:IUnknown:AddRef (This=0x58f25d0) returned 0x3 [0331.839] WbemDefPath:IUnknown:Release (This=0x58f25d0) returned 0x2 [0331.839] WbemDefPath:IWbemPath:SetText (This=0x58f25d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3816\"") returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.839] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.839] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f6e0*=0, plFlavor=0x239f6e4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x239f6e0*=19, plFlavor=0x239f6e4*=0) returned 0x0 [0331.839] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f6e0*=19, plFlavor=0x239f6e4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xee8, varVal2=0x0), pType=0x239f6e0*=19, plFlavor=0x239f6e4*=0) returned 0x0 [0331.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.840] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f7e4*=0, plFlavor=0x239f7e8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x239f7e4*=8, plFlavor=0x239f7e8*=0) returned 0x0 [0331.840] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0331.840] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0331.840] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f7e4*=8, plFlavor=0x239f7e8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="smartftp.exe", varVal2=0x0), pType=0x239f7e4*=8, plFlavor=0x239f7e8*=0) returned 0x0 [0331.840] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0331.840] SysStringByteLen (bstr="smartftp.exe") returned 0x18 [0331.840] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.840] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.840] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f928*=0, plFlavor=0x239f92c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ", varVal2=0x0), pType=0x239f928*=8, plFlavor=0x239f92c*=0) returned 0x0 [0331.841] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0331.841] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0331.841] IWbemClassObject:Get (in: This=0x58fe3c0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x239f928*=8, plFlavor=0x239f92c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ", varVal2=0x0), pType=0x239f928*=8, plFlavor=0x239f92c*=0) returned 0x0 [0331.841] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0331.841] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Analysis Services\\smartftp.exe\" ") returned 0x84 [0331.841] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0331.841] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x58fcd70, puReturned=0x2377db0*=0x1) returned 0x0 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fcd70) returned 0x0 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.844] IUnknown:AddRef (This=0x58fcd70) returned 0x3 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.844] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fcd74) returned 0x0 [0331.844] IMarshal:GetUnmarshalClass (in: This=0x58fcd74, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.844] IUnknown:Release (This=0x58fcd74) returned 0x3 [0331.844] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.845] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.845] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.845] IUnknown:Release (This=0x58fcd70) returned 0x2 [0331.845] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.845] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.845] IUnknown:QueryInterface (in: This=0x58fcd70, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fcd70) returned 0x0 [0331.845] IUnknown:AddRef (This=0x58fcd70) returned 0x4 [0331.845] IUnknown:Release (This=0x58fcd70) returned 0x3 [0331.845] IUnknown:Release (This=0x58fcd70) returned 0x2 [0331.845] CoTaskMemFree (pv=0x586b340) [0331.845] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.845] IUnknown:AddRef (This=0x58fcd70) returned 0x3 [0331.845] IWbemClassObject:Get (in: This=0x58fcd70, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.845] IWbemClassObject:Get (in: This=0x58fcd70, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.845] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0331.846] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x5e [0331.846] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.846] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.846] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.846] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.847] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0331.847] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.847] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905740) returned 0x0 [0331.848] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905740) returned 0x0 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.848] WbemDefPath:IUnknown:AddRef (This=0x5905740) returned 0x3 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3918) returned 0x0 [0331.848] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3918, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.848] WbemDefPath:IUnknown:Release (This=0x58f3918) returned 0x3 [0331.849] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.849] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.849] WbemDefPath:IUnknown:Release (This=0x5905740) returned 0x2 [0331.849] WbemDefPath:IUnknown:Release (This=0x5905740) returned 0x1 [0331.849] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.849] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905740, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905740) returned 0x0 [0331.849] WbemDefPath:IUnknown:AddRef (This=0x5905740) returned 0x3 [0331.849] WbemDefPath:IUnknown:Release (This=0x5905740) returned 0x2 [0331.849] WbemDefPath:IWbemPath:SetText (This=0x5905740, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3828\"") returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.849] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.850] IWbemClassObject:Get (in: This=0x58fcd70, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a03dc*=0, plFlavor=0x23a03e0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x23a03dc*=19, plFlavor=0x23a03e0*=0) returned 0x0 [0331.850] IWbemClassObject:Get (in: This=0x58fcd70, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a03dc*=19, plFlavor=0x23a03e0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xef4, varVal2=0x0), pType=0x23a03dc*=19, plFlavor=0x23a03e0*=0) returned 0x0 [0331.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.850] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.850] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.850] IWbemClassObject:Get (in: This=0x58fcd70, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a04e0*=0, plFlavor=0x23a04e4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x23a04e0*=8, plFlavor=0x23a04e4*=0) returned 0x0 [0331.850] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0331.850] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0331.850] IWbemClassObject:Get (in: This=0x58fcd70, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a04e0*=8, plFlavor=0x23a04e4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="thunderbird.exe", varVal2=0x0), pType=0x23a04e0*=8, plFlavor=0x23a04e4*=0) returned 0x0 [0331.850] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0331.851] SysStringByteLen (bstr="thunderbird.exe") returned 0x1e [0331.851] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.851] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.851] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.851] IWbemClassObject:Get (in: This=0x58fcd70, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a062c*=0, plFlavor=0x23a0630*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ", varVal2=0x0), pType=0x23a062c*=8, plFlavor=0x23a0630*=0) returned 0x0 [0331.851] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0331.851] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0331.851] IWbemClassObject:Get (in: This=0x58fcd70, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a062c*=8, plFlavor=0x23a0630*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ", varVal2=0x0), pType=0x23a062c*=8, plFlavor=0x23a0630*=0) returned 0x0 [0331.851] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0331.851] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\thunderbird.exe\" ") returned 0x74 [0331.852] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.852] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fdbc8, puReturned=0x2377db0*=0x1) returned 0x0 [0331.907] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fdbc8) returned 0x0 [0331.907] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.907] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.908] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.908] IUnknown:AddRef (This=0x58fdbc8) returned 0x3 [0331.908] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.908] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.908] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fdbcc) returned 0x0 [0331.908] IMarshal:GetUnmarshalClass (in: This=0x58fdbcc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.908] IUnknown:Release (This=0x58fdbcc) returned 0x3 [0331.908] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.908] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.908] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.909] IUnknown:Release (This=0x58fdbc8) returned 0x2 [0331.909] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.909] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.909] IUnknown:QueryInterface (in: This=0x58fdbc8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fdbc8) returned 0x0 [0331.909] IUnknown:AddRef (This=0x58fdbc8) returned 0x4 [0331.909] IUnknown:Release (This=0x58fdbc8) returned 0x3 [0331.909] IUnknown:Release (This=0x58fdbc8) returned 0x2 [0331.909] CoTaskMemFree (pv=0x586b460) [0331.909] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.909] IUnknown:AddRef (This=0x58fdbc8) returned 0x3 [0331.909] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.909] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.910] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0331.910] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x5e [0331.910] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.910] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.910] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.910] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.911] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0331.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.912] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59060e0) returned 0x0 [0331.912] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0331.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59060e0) returned 0x0 [0331.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.912] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.912] WbemDefPath:IUnknown:AddRef (This=0x59060e0) returned 0x3 [0331.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3b40) returned 0x0 [0331.913] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3b40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.913] WbemDefPath:IUnknown:Release (This=0x58f3b40) returned 0x3 [0331.913] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.913] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.913] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.913] WbemDefPath:IUnknown:Release (This=0x59060e0) returned 0x2 [0331.913] WbemDefPath:IUnknown:Release (This=0x59060e0) returned 0x1 [0331.913] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.914] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x59060e0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59060e0) returned 0x0 [0331.914] WbemDefPath:IUnknown:AddRef (This=0x59060e0) returned 0x3 [0331.914] WbemDefPath:IUnknown:Release (This=0x59060e0) returned 0x2 [0331.914] WbemDefPath:IWbemPath:SetText (This=0x59060e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3836\"") returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.914] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.914] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a10b8*=0, plFlavor=0x23a10bc*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x23a10b8*=19, plFlavor=0x23a10bc*=0) returned 0x0 [0331.915] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a10b8*=19, plFlavor=0x23a10bc*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xefc, varVal2=0x0), pType=0x23a10b8*=19, plFlavor=0x23a10bc*=0) returned 0x0 [0331.915] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.915] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.915] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.915] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a11bc*=0, plFlavor=0x23a11c0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x23a11bc*=8, plFlavor=0x23a11c0*=0) returned 0x0 [0331.915] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0331.915] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0331.915] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a11bc*=8, plFlavor=0x23a11c0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="trillian.exe", varVal2=0x0), pType=0x23a11bc*=8, plFlavor=0x23a11c0*=0) returned 0x0 [0331.915] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0331.915] SysStringByteLen (bstr="trillian.exe") returned 0x18 [0331.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.916] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.916] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.916] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1300*=0, plFlavor=0x23a1304*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\trillian.exe\" ", varVal2=0x0), pType=0x23a1300*=8, plFlavor=0x23a1304*=0) returned 0x0 [0331.916] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0331.916] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0331.916] IWbemClassObject:Get (in: This=0x58fdbc8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1300*=8, plFlavor=0x23a1304*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\MSBuild\\trillian.exe\" ", varVal2=0x0), pType=0x23a1300*=8, plFlavor=0x23a1304*=0) returned 0x0 [0331.916] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0331.916] SysStringByteLen (bstr="\"C:\\Program Files\\MSBuild\\trillian.exe\" ") returned 0x50 [0331.917] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.917] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fdef8, puReturned=0x2377db0*=0x1) returned 0x0 [0331.919] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fdef8) returned 0x0 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.920] IUnknown:AddRef (This=0x58fdef8) returned 0x3 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fdefc) returned 0x0 [0331.920] IMarshal:GetUnmarshalClass (in: This=0x58fdefc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.920] IUnknown:Release (This=0x58fdefc) returned 0x3 [0331.920] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.920] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.920] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.921] IUnknown:Release (This=0x58fdef8) returned 0x2 [0331.921] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.921] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.921] IUnknown:QueryInterface (in: This=0x58fdef8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fdef8) returned 0x0 [0331.921] IUnknown:AddRef (This=0x58fdef8) returned 0x4 [0331.921] IUnknown:Release (This=0x58fdef8) returned 0x3 [0331.921] IUnknown:Release (This=0x58fdef8) returned 0x2 [0331.921] CoTaskMemFree (pv=0x586b460) [0331.921] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.922] IUnknown:AddRef (This=0x58fdef8) returned 0x3 [0331.922] IWbemClassObject:Get (in: This=0x58fdef8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.922] IWbemClassObject:Get (in: This=0x58fdef8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.922] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0331.922] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x5e [0331.922] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.923] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.923] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.923] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.924] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0331.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.924] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905820) returned 0x0 [0331.924] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0331.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905820) returned 0x0 [0331.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.925] WbemDefPath:IUnknown:AddRef (This=0x5905820) returned 0x3 [0331.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3990) returned 0x0 [0331.925] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3990, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.925] WbemDefPath:IUnknown:Release (This=0x58f3990) returned 0x3 [0331.925] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.926] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.926] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x2 [0331.926] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x1 [0331.926] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.926] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.926] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905820) returned 0x0 [0331.926] WbemDefPath:IUnknown:AddRef (This=0x5905820) returned 0x3 [0331.926] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x2 [0331.926] WbemDefPath:IWbemPath:SetText (This=0x5905820, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3852\"") returned 0x0 [0331.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.926] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.926] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.927] IWbemClassObject:Get (in: This=0x58fdef8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1d18*=0, plFlavor=0x23a1d1c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x23a1d18*=19, plFlavor=0x23a1d1c*=0) returned 0x0 [0331.927] IWbemClassObject:Get (in: This=0x58fdef8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1d18*=19, plFlavor=0x23a1d1c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf0c, varVal2=0x0), pType=0x23a1d18*=19, plFlavor=0x23a1d1c*=0) returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.927] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.927] IWbemClassObject:Get (in: This=0x58fdef8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1e1c*=0, plFlavor=0x23a1e20*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x23a1e1c*=8, plFlavor=0x23a1e20*=0) returned 0x0 [0331.928] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0331.928] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0331.928] IWbemClassObject:Get (in: This=0x58fdef8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1e1c*=8, plFlavor=0x23a1e20*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="webdrive.exe", varVal2=0x0), pType=0x23a1e1c*=8, plFlavor=0x23a1e20*=0) returned 0x0 [0331.928] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0331.928] SysStringByteLen (bstr="webdrive.exe") returned 0x18 [0331.928] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.928] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.929] IWbemClassObject:Get (in: This=0x58fdef8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1f60*=0, plFlavor=0x23a1f64*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ", varVal2=0x0), pType=0x23a1f60*=8, plFlavor=0x23a1f64*=0) returned 0x0 [0331.929] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0331.929] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0331.929] IWbemClassObject:Get (in: This=0x58fdef8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a1f60*=8, plFlavor=0x23a1f64*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ", varVal2=0x0), pType=0x23a1f60*=8, plFlavor=0x23a1f64*=0) returned 0x0 [0331.929] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0331.929] SysStringByteLen (bstr="\"C:\\Program Files\\WindowsPowerShell\\webdrive.exe\" ") returned 0x64 [0331.929] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0331.929] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fe090, puReturned=0x2377db0*=0x1) returned 0x0 [0331.933] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fe090) returned 0x0 [0331.933] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.933] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.933] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.934] IUnknown:AddRef (This=0x58fe090) returned 0x3 [0331.934] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.934] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.934] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fe094) returned 0x0 [0331.934] IMarshal:GetUnmarshalClass (in: This=0x58fe094, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.934] IUnknown:Release (This=0x58fe094) returned 0x3 [0331.934] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.934] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.935] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.935] IUnknown:Release (This=0x58fe090) returned 0x2 [0331.935] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.935] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.935] IUnknown:QueryInterface (in: This=0x58fe090, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fe090) returned 0x0 [0331.935] IUnknown:AddRef (This=0x58fe090) returned 0x4 [0331.935] IUnknown:Release (This=0x58fe090) returned 0x3 [0331.935] IUnknown:Release (This=0x58fe090) returned 0x2 [0331.935] CoTaskMemFree (pv=0x586b460) [0331.935] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.935] IUnknown:AddRef (This=0x58fe090) returned 0x3 [0331.935] IWbemClassObject:Get (in: This=0x58fe090, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.936] IWbemClassObject:Get (in: This=0x58fe090, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.936] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0331.936] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x5e [0331.936] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.936] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.936] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.937] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.938] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b380) returned 0x0 [0331.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b380, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.939] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b380, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906150) returned 0x0 [0331.939] WbemDefPath:IUnknown:Release (This=0x586b380) returned 0x0 [0331.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906150) returned 0x0 [0331.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0331.939] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0331.939] WbemDefPath:IUnknown:AddRef (This=0x5906150) returned 0x3 [0331.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0331.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0331.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3de0) returned 0x0 [0331.940] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3de0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0331.940] WbemDefPath:IUnknown:Release (This=0x58f3de0) returned 0x3 [0331.940] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0331.940] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0331.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0331.940] WbemDefPath:IUnknown:Release (This=0x5906150) returned 0x2 [0331.940] WbemDefPath:IUnknown:Release (This=0x5906150) returned 0x1 [0331.940] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0331.940] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0331.940] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906150, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906150) returned 0x0 [0331.940] WbemDefPath:IUnknown:AddRef (This=0x5906150) returned 0x3 [0331.941] WbemDefPath:IUnknown:Release (This=0x5906150) returned 0x2 [0331.941] WbemDefPath:IWbemPath:SetText (This=0x5906150, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3868\"") returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.941] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.941] IWbemClassObject:Get (in: This=0x58fe090, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a29b4*=0, plFlavor=0x23a29b8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf1c, varVal2=0x0), pType=0x23a29b4*=19, plFlavor=0x23a29b8*=0) returned 0x0 [0331.941] IWbemClassObject:Get (in: This=0x58fe090, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a29b4*=19, plFlavor=0x23a29b8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf1c, varVal2=0x0), pType=0x23a29b4*=19, plFlavor=0x23a29b8*=0) returned 0x0 [0331.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.942] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.942] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.942] IWbemClassObject:Get (in: This=0x58fe090, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a2ab8*=0, plFlavor=0x23a2abc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x23a2ab8*=8, plFlavor=0x23a2abc*=0) returned 0x0 [0331.942] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0331.942] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0331.942] IWbemClassObject:Get (in: This=0x58fe090, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a2ab8*=8, plFlavor=0x23a2abc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="whatsapp.exe", varVal2=0x0), pType=0x23a2ab8*=8, plFlavor=0x23a2abc*=0) returned 0x0 [0331.942] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0331.942] SysStringByteLen (bstr="whatsapp.exe") returned 0x18 [0331.942] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0331.943] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0331.943] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0331.943] IWbemClassObject:Get (in: This=0x58fe090, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a2bfc*=0, plFlavor=0x23a2c00*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ", varVal2=0x0), pType=0x23a2bfc*=8, plFlavor=0x23a2c00*=0) returned 0x0 [0331.943] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0331.943] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0331.943] IWbemClassObject:Get (in: This=0x58fe090, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a2bfc*=8, plFlavor=0x23a2c00*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ", varVal2=0x0), pType=0x23a2bfc*=8, plFlavor=0x23a2c00*=0) returned 0x0 [0331.943] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0331.943] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\whatsapp.exe\" ") returned 0x5c [0331.943] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0331.944] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58fe558, puReturned=0x2377db0*=0x1) returned 0x0 [0331.994] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fe558) returned 0x0 [0331.994] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0331.994] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0331.994] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0331.994] IUnknown:AddRef (This=0x58fe558) returned 0x3 [0331.994] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0331.995] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0331.995] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fe55c) returned 0x0 [0331.995] IMarshal:GetUnmarshalClass (in: This=0x58fe55c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0331.995] IUnknown:Release (This=0x58fe55c) returned 0x3 [0331.995] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0331.995] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0331.995] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0331.995] IUnknown:Release (This=0x58fe558) returned 0x2 [0331.995] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0331.995] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0331.995] IUnknown:QueryInterface (in: This=0x58fe558, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fe558) returned 0x0 [0331.995] IUnknown:AddRef (This=0x58fe558) returned 0x4 [0331.996] IUnknown:Release (This=0x58fe558) returned 0x3 [0331.996] IUnknown:Release (This=0x58fe558) returned 0x2 [0331.996] CoTaskMemFree (pv=0x586b2e0) [0331.996] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0331.996] IUnknown:AddRef (This=0x58fe558) returned 0x3 [0331.996] IWbemClassObject:Get (in: This=0x58fe558, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0331.997] IWbemClassObject:Get (in: This=0x58fe558, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0331.997] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0331.997] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x5e [0331.997] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0331.997] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0331.997] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0331.998] IUnknown:Release (This=0x692bc4) returned 0x1 [0331.999] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0331.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0331.999] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906000) returned 0x0 [0331.999] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906000) returned 0x0 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.000] WbemDefPath:IUnknown:AddRef (This=0x5906000) returned 0x3 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.000] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f3d68) returned 0x0 [0332.000] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f3d68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.000] WbemDefPath:IUnknown:Release (This=0x58f3d68) returned 0x3 [0332.000] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.001] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.001] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.001] WbemDefPath:IUnknown:Release (This=0x5906000) returned 0x2 [0332.001] WbemDefPath:IUnknown:Release (This=0x5906000) returned 0x1 [0332.001] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.001] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.001] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906000, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906000) returned 0x0 [0332.001] WbemDefPath:IUnknown:AddRef (This=0x5906000) returned 0x3 [0332.001] WbemDefPath:IUnknown:Release (This=0x5906000) returned 0x2 [0332.001] WbemDefPath:IWbemPath:SetText (This=0x5906000, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3876\"") returned 0x0 [0332.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.001] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.002] IWbemClassObject:Get (in: This=0x58fe558, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a3638*=0, plFlavor=0x23a363c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x23a3638*=19, plFlavor=0x23a363c*=0) returned 0x0 [0332.002] IWbemClassObject:Get (in: This=0x58fe558, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a3638*=19, plFlavor=0x23a363c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf24, varVal2=0x0), pType=0x23a3638*=19, plFlavor=0x23a363c*=0) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.002] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.003] IWbemClassObject:Get (in: This=0x58fe558, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a373c*=0, plFlavor=0x23a3740*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x23a373c*=8, plFlavor=0x23a3740*=0) returned 0x0 [0332.003] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0332.003] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0332.003] IWbemClassObject:Get (in: This=0x58fe558, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a373c*=8, plFlavor=0x23a3740*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winscp.exe", varVal2=0x0), pType=0x23a373c*=8, plFlavor=0x23a3740*=0) returned 0x0 [0332.003] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0332.003] SysStringByteLen (bstr="winscp.exe") returned 0x14 [0332.003] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.003] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.003] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.003] IWbemClassObject:Get (in: This=0x58fe558, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a3878*=0, plFlavor=0x23a387c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ", varVal2=0x0), pType=0x23a3878*=8, plFlavor=0x23a387c*=0) returned 0x0 [0332.004] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0332.004] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0332.004] IWbemClassObject:Get (in: This=0x58fe558, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a3878*=8, plFlavor=0x23a387c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ", varVal2=0x0), pType=0x23a3878*=8, plFlavor=0x23a387c*=0) returned 0x0 [0332.004] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0332.004] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Sidebar\\winscp.exe\" ") returned 0x68 [0332.004] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.004] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fc710, puReturned=0x2377db0*=0x1) returned 0x0 [0332.006] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fc710) returned 0x0 [0332.006] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.006] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.006] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.007] IUnknown:AddRef (This=0x58fc710) returned 0x3 [0332.007] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.007] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.007] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fc714) returned 0x0 [0332.007] IMarshal:GetUnmarshalClass (in: This=0x58fc714, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.007] IUnknown:Release (This=0x58fc714) returned 0x3 [0332.007] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.007] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.007] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.007] IUnknown:Release (This=0x58fc710) returned 0x2 [0332.008] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.008] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.008] IUnknown:QueryInterface (in: This=0x58fc710, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fc710) returned 0x0 [0332.008] IUnknown:AddRef (This=0x58fc710) returned 0x4 [0332.008] IUnknown:Release (This=0x58fc710) returned 0x3 [0332.008] IUnknown:Release (This=0x58fc710) returned 0x2 [0332.008] CoTaskMemFree (pv=0x586b460) [0332.008] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.008] IUnknown:AddRef (This=0x58fc710) returned 0x3 [0332.008] IWbemClassObject:Get (in: This=0x58fc710, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.008] IWbemClassObject:Get (in: This=0x58fc710, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.008] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0332.009] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x5e [0332.009] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.009] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.009] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.009] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.010] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0332.010] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.010] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59057b0) returned 0x0 [0332.010] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59057b0) returned 0x0 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.011] WbemDefPath:IUnknown:AddRef (This=0x59057b0) returned 0x3 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4170) returned 0x0 [0332.011] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4170, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.011] WbemDefPath:IUnknown:Release (This=0x58f4170) returned 0x3 [0332.011] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.012] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.012] WbemDefPath:IUnknown:Release (This=0x59057b0) returned 0x2 [0332.012] WbemDefPath:IUnknown:Release (This=0x59057b0) returned 0x1 [0332.012] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.012] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x59057b0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59057b0) returned 0x0 [0332.012] WbemDefPath:IUnknown:AddRef (This=0x59057b0) returned 0x3 [0332.012] WbemDefPath:IUnknown:Release (This=0x59057b0) returned 0x2 [0332.012] WbemDefPath:IWbemPath:SetText (This=0x59057b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3896\"") returned 0x0 [0332.012] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.013] IWbemClassObject:Get (in: This=0x58fc710, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a42d4*=0, plFlavor=0x23a42d8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x23a42d4*=19, plFlavor=0x23a42d8*=0) returned 0x0 [0332.013] IWbemClassObject:Get (in: This=0x58fc710, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a42d4*=19, plFlavor=0x23a42d8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf38, varVal2=0x0), pType=0x23a42d4*=19, plFlavor=0x23a42d8*=0) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.013] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.014] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.014] IWbemClassObject:Get (in: This=0x58fc710, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a43d8*=0, plFlavor=0x23a43dc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x23a43d8*=8, plFlavor=0x23a43dc*=0) returned 0x0 [0332.014] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0332.014] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0332.014] IWbemClassObject:Get (in: This=0x58fc710, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a43d8*=8, plFlavor=0x23a43dc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="yahoomessenger.exe", varVal2=0x0), pType=0x23a43d8*=8, plFlavor=0x23a43dc*=0) returned 0x0 [0332.014] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0332.014] SysStringByteLen (bstr="yahoomessenger.exe") returned 0x24 [0332.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.014] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.014] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.015] IWbemClassObject:Get (in: This=0x58fc710, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a4534*=0, plFlavor=0x23a4538*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ", varVal2=0x0), pType=0x23a4534*=8, plFlavor=0x23a4538*=0) returned 0x0 [0332.015] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0332.015] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0332.015] IWbemClassObject:Get (in: This=0x58fc710, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a4534*=8, plFlavor=0x23a4538*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ", varVal2=0x0), pType=0x23a4534*=8, plFlavor=0x23a4538*=0) returned 0x0 [0332.016] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0332.016] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows Mail\\yahoomessenger.exe\" ") returned 0x72 [0332.016] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.016] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x58fc8a8, puReturned=0x2377db0*=0x1) returned 0x0 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fc8a8) returned 0x0 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.019] IUnknown:AddRef (This=0x58fc8a8) returned 0x3 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.019] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.020] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fc8ac) returned 0x0 [0332.020] IMarshal:GetUnmarshalClass (in: This=0x58fc8ac, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.020] IUnknown:Release (This=0x58fc8ac) returned 0x3 [0332.020] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.020] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.020] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.020] IUnknown:Release (This=0x58fc8a8) returned 0x2 [0332.020] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.020] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.020] IUnknown:QueryInterface (in: This=0x58fc8a8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fc8a8) returned 0x0 [0332.020] IUnknown:AddRef (This=0x58fc8a8) returned 0x4 [0332.021] IUnknown:Release (This=0x58fc8a8) returned 0x3 [0332.021] IUnknown:Release (This=0x58fc8a8) returned 0x2 [0332.021] CoTaskMemFree (pv=0x586b2e0) [0332.021] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.021] IUnknown:AddRef (This=0x58fc8a8) returned 0x3 [0332.021] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.021] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.021] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0332.021] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x5e [0332.021] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.022] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.022] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.022] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.023] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0332.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.023] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906230) returned 0x0 [0332.023] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0332.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906230) returned 0x0 [0332.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.024] WbemDefPath:IUnknown:AddRef (This=0x5906230) returned 0x3 [0332.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4110) returned 0x0 [0332.024] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4110, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.024] WbemDefPath:IUnknown:Release (This=0x58f4110) returned 0x3 [0332.024] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.024] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.025] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.025] WbemDefPath:IUnknown:Release (This=0x5906230) returned 0x2 [0332.025] WbemDefPath:IUnknown:Release (This=0x5906230) returned 0x1 [0332.025] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.025] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.025] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906230, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906230) returned 0x0 [0332.025] WbemDefPath:IUnknown:AddRef (This=0x5906230) returned 0x3 [0332.025] WbemDefPath:IUnknown:Release (This=0x5906230) returned 0x2 [0332.025] WbemDefPath:IWbemPath:SetText (This=0x5906230, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3908\"") returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.025] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.026] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a4fbc*=0, plFlavor=0x23a4fc0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x23a4fbc*=19, plFlavor=0x23a4fc0*=0) returned 0x0 [0332.026] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a4fbc*=19, plFlavor=0x23a4fc0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf44, varVal2=0x0), pType=0x23a4fbc*=19, plFlavor=0x23a4fc0*=0) returned 0x0 [0332.026] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.026] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.026] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.026] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a50c0*=0, plFlavor=0x23a50c4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x23a50c0*=8, plFlavor=0x23a50c4*=0) returned 0x0 [0332.026] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0332.026] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0332.026] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a50c0*=8, plFlavor=0x23a50c4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="active-charge.exe", varVal2=0x0), pType=0x23a50c0*=8, plFlavor=0x23a50c4*=0) returned 0x0 [0332.027] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0332.027] SysStringByteLen (bstr="active-charge.exe") returned 0x22 [0332.027] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.027] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.027] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.027] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5214*=0, plFlavor=0x23a5218*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ", varVal2=0x0), pType=0x23a5214*=8, plFlavor=0x23a5218*=0) returned 0x0 [0332.027] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0332.027] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0332.027] IWbemClassObject:Get (in: This=0x58fc8a8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5214*=8, plFlavor=0x23a5218*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ", varVal2=0x0), pType=0x23a5214*=8, plFlavor=0x23a5218*=0) returned 0x0 [0332.027] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0332.028] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\active-charge.exe\" ") returned 0x74 [0332.028] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.028] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fcbd8, puReturned=0x2377db0*=0x1) returned 0x0 [0332.080] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fcbd8) returned 0x0 [0332.080] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.080] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.080] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.081] IUnknown:AddRef (This=0x58fcbd8) returned 0x3 [0332.081] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.081] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.081] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fcbdc) returned 0x0 [0332.081] IMarshal:GetUnmarshalClass (in: This=0x58fcbdc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.081] IUnknown:Release (This=0x58fcbdc) returned 0x3 [0332.081] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.081] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.081] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.081] IUnknown:Release (This=0x58fcbd8) returned 0x2 [0332.082] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.082] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.082] IUnknown:QueryInterface (in: This=0x58fcbd8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fcbd8) returned 0x0 [0332.082] IUnknown:AddRef (This=0x58fcbd8) returned 0x4 [0332.082] IUnknown:Release (This=0x58fcbd8) returned 0x3 [0332.082] IUnknown:Release (This=0x58fcbd8) returned 0x2 [0332.082] CoTaskMemFree (pv=0x586b460) [0332.082] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.082] IUnknown:AddRef (This=0x58fcbd8) returned 0x3 [0332.082] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.082] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0332.083] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x5e [0332.083] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.083] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.083] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.083] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.084] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.085] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905890) returned 0x0 [0332.085] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905890) returned 0x0 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.085] WbemDefPath:IUnknown:AddRef (This=0x5905890) returned 0x3 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.085] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f44a0) returned 0x0 [0332.086] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f44a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.086] WbemDefPath:IUnknown:Release (This=0x58f44a0) returned 0x3 [0332.086] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.086] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.086] WbemDefPath:IUnknown:Release (This=0x5905890) returned 0x2 [0332.086] WbemDefPath:IUnknown:Release (This=0x5905890) returned 0x1 [0332.086] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.086] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.086] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905890, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905890) returned 0x0 [0332.086] WbemDefPath:IUnknown:AddRef (This=0x5905890) returned 0x3 [0332.086] WbemDefPath:IUnknown:Release (This=0x5905890) returned 0x2 [0332.086] WbemDefPath:IWbemPath:SetText (This=0x5905890, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3916\"") returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.087] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5ca4*=0, plFlavor=0x23a5ca8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf4c, varVal2=0x0), pType=0x23a5ca4*=19, plFlavor=0x23a5ca8*=0) returned 0x0 [0332.087] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5ca4*=19, plFlavor=0x23a5ca8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf4c, varVal2=0x0), pType=0x23a5ca4*=19, plFlavor=0x23a5ca8*=0) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.087] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.088] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5da8*=0, plFlavor=0x23a5dac*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x23a5da8*=8, plFlavor=0x23a5dac*=0) returned 0x0 [0332.088] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0332.088] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0332.088] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5da8*=8, plFlavor=0x23a5dac*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="accupos.exe", varVal2=0x0), pType=0x23a5da8*=8, plFlavor=0x23a5dac*=0) returned 0x0 [0332.088] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0332.088] SysStringByteLen (bstr="accupos.exe") returned 0x16 [0332.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.088] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.088] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5ee4*=0, plFlavor=0x23a5ee8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\accupos.exe\" ", varVal2=0x0), pType=0x23a5ee4*=8, plFlavor=0x23a5ee8*=0) returned 0x0 [0332.088] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0332.088] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0332.089] IWbemClassObject:Get (in: This=0x58fcbd8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a5ee4*=8, plFlavor=0x23a5ee8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Java\\accupos.exe\" ", varVal2=0x0), pType=0x23a5ee4*=8, plFlavor=0x23a5ee8*=0) returned 0x0 [0332.089] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0332.089] SysStringByteLen (bstr="\"C:\\Program Files\\Java\\accupos.exe\" ") returned 0x48 [0332.089] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0332.089] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x58fd0a0, puReturned=0x2377db0*=0x1) returned 0x0 [0332.092] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd0a0) returned 0x0 [0332.093] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.093] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.093] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.094] IUnknown:AddRef (This=0x58fd0a0) returned 0x3 [0332.094] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.094] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.094] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd0a4) returned 0x0 [0332.094] IMarshal:GetUnmarshalClass (in: This=0x58fd0a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.094] IUnknown:Release (This=0x58fd0a4) returned 0x3 [0332.094] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.095] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.095] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.095] IUnknown:Release (This=0x58fd0a0) returned 0x2 [0332.095] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.095] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.095] IUnknown:QueryInterface (in: This=0x58fd0a0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd0a0) returned 0x0 [0332.095] IUnknown:AddRef (This=0x58fd0a0) returned 0x4 [0332.095] IUnknown:Release (This=0x58fd0a0) returned 0x3 [0332.095] IUnknown:Release (This=0x58fd0a0) returned 0x2 [0332.095] CoTaskMemFree (pv=0x586b490) [0332.095] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.095] IUnknown:AddRef (This=0x58fd0a0) returned 0x3 [0332.095] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.096] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.097] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0332.097] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x5e [0332.097] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.097] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.097] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.097] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.099] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.099] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905900) returned 0x0 [0332.099] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905900) returned 0x0 [0332.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.100] WbemDefPath:IUnknown:AddRef (This=0x5905900) returned 0x3 [0332.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4608) returned 0x0 [0332.100] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4608, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.100] WbemDefPath:IUnknown:Release (This=0x58f4608) returned 0x3 [0332.100] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.100] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.100] WbemDefPath:IUnknown:Release (This=0x5905900) returned 0x2 [0332.101] WbemDefPath:IUnknown:Release (This=0x5905900) returned 0x1 [0332.101] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.101] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905900, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905900) returned 0x0 [0332.101] WbemDefPath:IUnknown:AddRef (This=0x5905900) returned 0x3 [0332.101] WbemDefPath:IUnknown:Release (This=0x5905900) returned 0x2 [0332.101] WbemDefPath:IWbemPath:SetText (This=0x5905900, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3928\"") returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.101] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.102] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a68e4*=0, plFlavor=0x23a68e8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf58, varVal2=0x0), pType=0x23a68e4*=19, plFlavor=0x23a68e8*=0) returned 0x0 [0332.102] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a68e4*=19, plFlavor=0x23a68e8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf58, varVal2=0x0), pType=0x23a68e4*=19, plFlavor=0x23a68e8*=0) returned 0x0 [0332.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.102] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.102] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.102] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a69e8*=0, plFlavor=0x23a69ec*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x23a69e8*=8, plFlavor=0x23a69ec*=0) returned 0x0 [0332.102] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0332.102] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0332.103] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a69e8*=8, plFlavor=0x23a69ec*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="afr38.exe", varVal2=0x0), pType=0x23a69e8*=8, plFlavor=0x23a69ec*=0) returned 0x0 [0332.103] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0332.103] SysStringByteLen (bstr="afr38.exe") returned 0x12 [0332.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.103] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.103] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a6b1c*=0, plFlavor=0x23a6b20*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ", varVal2=0x0), pType=0x23a6b1c*=8, plFlavor=0x23a6b20*=0) returned 0x0 [0332.103] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0332.103] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0332.103] IWbemClassObject:Get (in: This=0x58fd0a0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a6b1c*=8, plFlavor=0x23a6b20*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ", varVal2=0x0), pType=0x23a6b1c*=8, plFlavor=0x23a6b20*=0) returned 0x0 [0332.104] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0332.104] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Mozilla Firefox\\afr38.exe\" ") returned 0x66 [0332.104] CoTaskMemAlloc (cb=0x4) returned 0x586b380 [0332.104] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b380, puReturned=0x2377db0 | out: apObjects=0x586b380*=0x58fd3d0, puReturned=0x2377db0*=0x1) returned 0x0 [0332.105] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd3d0) returned 0x0 [0332.105] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.105] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.105] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.106] IUnknown:AddRef (This=0x58fd3d0) returned 0x3 [0332.106] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.106] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.106] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd3d4) returned 0x0 [0332.106] IMarshal:GetUnmarshalClass (in: This=0x58fd3d4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.106] IUnknown:Release (This=0x58fd3d4) returned 0x3 [0332.106] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.106] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.106] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.106] IUnknown:Release (This=0x58fd3d0) returned 0x2 [0332.106] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.106] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.106] IUnknown:QueryInterface (in: This=0x58fd3d0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd3d0) returned 0x0 [0332.106] IUnknown:AddRef (This=0x58fd3d0) returned 0x4 [0332.106] IUnknown:Release (This=0x58fd3d0) returned 0x3 [0332.107] IUnknown:Release (This=0x58fd3d0) returned 0x2 [0332.107] CoTaskMemFree (pv=0x586b380) [0332.107] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.107] IUnknown:AddRef (This=0x58fd3d0) returned 0x3 [0332.107] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.107] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.107] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0332.107] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x5e [0332.107] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.107] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.108] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.108] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.109] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0332.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.109] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906070) returned 0x0 [0332.109] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0332.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906070) returned 0x0 [0332.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.110] WbemDefPath:IUnknown:AddRef (This=0x5906070) returned 0x3 [0332.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4698) returned 0x0 [0332.110] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4698, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.110] WbemDefPath:IUnknown:Release (This=0x58f4698) returned 0x3 [0332.110] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.110] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.110] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.110] WbemDefPath:IUnknown:Release (This=0x5906070) returned 0x2 [0332.110] WbemDefPath:IUnknown:Release (This=0x5906070) returned 0x1 [0332.110] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.110] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.111] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906070, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906070) returned 0x0 [0332.111] WbemDefPath:IUnknown:AddRef (This=0x5906070) returned 0x3 [0332.111] WbemDefPath:IUnknown:Release (This=0x5906070) returned 0x2 [0332.111] WbemDefPath:IWbemPath:SetText (This=0x5906070, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3948\"") returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.111] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.111] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a756c*=0, plFlavor=0x23a7570*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x23a756c*=19, plFlavor=0x23a7570*=0) returned 0x0 [0332.111] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a756c*=19, plFlavor=0x23a7570*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf6c, varVal2=0x0), pType=0x23a756c*=19, plFlavor=0x23a7570*=0) returned 0x0 [0332.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.112] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.112] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.112] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a7670*=0, plFlavor=0x23a7674*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x23a7670*=8, plFlavor=0x23a7674*=0) returned 0x0 [0332.112] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0332.112] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0332.112] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a7670*=8, plFlavor=0x23a7674*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="aldelo.exe", varVal2=0x0), pType=0x23a7670*=8, plFlavor=0x23a7674*=0) returned 0x0 [0332.112] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0332.112] SysStringByteLen (bstr="aldelo.exe") returned 0x14 [0332.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.113] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.113] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.113] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a77ac*=0, plFlavor=0x23a77b0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ", varVal2=0x0), pType=0x23a77ac*=8, plFlavor=0x23a77b0*=0) returned 0x0 [0332.113] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0332.113] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0332.113] IWbemClassObject:Get (in: This=0x58fd3d0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a77ac*=8, plFlavor=0x23a77b0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ", varVal2=0x0), pType=0x23a77ac*=8, plFlavor=0x23a77b0*=0) returned 0x0 [0332.113] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0332.113] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft Office\\aldelo.exe\" ") returned 0x6a [0332.113] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.113] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fd568, puReturned=0x2377db0*=0x1) returned 0x0 [0332.160] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd568) returned 0x0 [0332.160] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.160] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.161] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.161] IUnknown:AddRef (This=0x58fd568) returned 0x3 [0332.161] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.161] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.161] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd56c) returned 0x0 [0332.161] IMarshal:GetUnmarshalClass (in: This=0x58fd56c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.161] IUnknown:Release (This=0x58fd56c) returned 0x3 [0332.161] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.161] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.161] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.161] IUnknown:Release (This=0x58fd568) returned 0x2 [0332.161] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.161] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.162] IUnknown:QueryInterface (in: This=0x58fd568, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd568) returned 0x0 [0332.162] IUnknown:AddRef (This=0x58fd568) returned 0x4 [0332.162] IUnknown:Release (This=0x58fd568) returned 0x3 [0332.162] IUnknown:Release (This=0x58fd568) returned 0x2 [0332.162] CoTaskMemFree (pv=0x586b460) [0332.162] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.162] IUnknown:AddRef (This=0x58fd568) returned 0x3 [0332.162] IWbemClassObject:Get (in: This=0x58fd568, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.162] IWbemClassObject:Get (in: This=0x58fd568, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.162] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0332.162] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x5e [0332.162] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.162] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.163] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.163] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.163] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.164] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905c80) returned 0x0 [0332.164] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905c80) returned 0x0 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.164] WbemDefPath:IUnknown:AddRef (This=0x5905c80) returned 0x3 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4b18) returned 0x0 [0332.164] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4b18, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.164] WbemDefPath:IUnknown:Release (This=0x58f4b18) returned 0x3 [0332.164] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.165] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.165] WbemDefPath:IUnknown:Release (This=0x5905c80) returned 0x2 [0332.165] WbemDefPath:IUnknown:Release (This=0x5905c80) returned 0x1 [0332.165] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.165] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.165] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c80, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905c80) returned 0x0 [0332.165] WbemDefPath:IUnknown:AddRef (This=0x5905c80) returned 0x3 [0332.165] WbemDefPath:IUnknown:Release (This=0x5905c80) returned 0x2 [0332.165] WbemDefPath:IWbemPath:SetText (This=0x5905c80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3956\"") returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.165] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.165] IWbemClassObject:Get (in: This=0x58fd568, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a820c*=0, plFlavor=0x23a8210*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf74, varVal2=0x0), pType=0x23a820c*=19, plFlavor=0x23a8210*=0) returned 0x0 [0332.165] IWbemClassObject:Get (in: This=0x58fd568, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a820c*=19, plFlavor=0x23a8210*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf74, varVal2=0x0), pType=0x23a820c*=19, plFlavor=0x23a8210*=0) returned 0x0 [0332.166] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.166] IWbemClassObject:Get (in: This=0x58fd568, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8310*=0, plFlavor=0x23a8314*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x23a8310*=8, plFlavor=0x23a8314*=0) returned 0x0 [0332.166] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0332.166] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0332.166] IWbemClassObject:Get (in: This=0x58fd568, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8310*=8, plFlavor=0x23a8314*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ccv_server.exe", varVal2=0x0), pType=0x23a8310*=8, plFlavor=0x23a8314*=0) returned 0x0 [0332.166] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0332.166] SysStringByteLen (bstr="ccv_server.exe") returned 0x1c [0332.166] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.167] IWbemClassObject:Get (in: This=0x58fd568, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a845c*=0, plFlavor=0x23a8460*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ", varVal2=0x0), pType=0x23a845c*=8, plFlavor=0x23a8460*=0) returned 0x0 [0332.167] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0332.167] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0332.167] IWbemClassObject:Get (in: This=0x58fd568, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a845c*=8, plFlavor=0x23a8460*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ", varVal2=0x0), pType=0x23a845c*=8, plFlavor=0x23a8460*=0) returned 0x0 [0332.167] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0332.167] SysStringByteLen (bstr="\"C:\\Program Files\\Reference Assemblies\\ccv_server.exe\" ") returned 0x6e [0332.167] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.167] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x58fd700, puReturned=0x2377db0*=0x1) returned 0x0 [0332.169] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x58fd700) returned 0x0 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.170] IUnknown:AddRef (This=0x58fd700) returned 0x3 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x58fd704) returned 0x0 [0332.170] IMarshal:GetUnmarshalClass (in: This=0x58fd704, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.170] IUnknown:Release (This=0x58fd704) returned 0x3 [0332.170] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.170] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.170] IUnknown:Release (This=0x58fd700) returned 0x2 [0332.170] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.170] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.170] IUnknown:QueryInterface (in: This=0x58fd700, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x58fd700) returned 0x0 [0332.171] IUnknown:AddRef (This=0x58fd700) returned 0x4 [0332.171] IUnknown:Release (This=0x58fd700) returned 0x3 [0332.171] IUnknown:Release (This=0x58fd700) returned 0x2 [0332.171] CoTaskMemFree (pv=0x586b460) [0332.171] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.171] IUnknown:AddRef (This=0x58fd700) returned 0x3 [0332.171] IWbemClassObject:Get (in: This=0x58fd700, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.171] IWbemClassObject:Get (in: This=0x58fd700, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.171] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0332.171] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x5e [0332.171] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.172] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.172] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.172] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.173] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b360) returned 0x0 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.173] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59061c0) returned 0x0 [0332.173] WbemDefPath:IUnknown:Release (This=0x586b360) returned 0x0 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59061c0) returned 0x0 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.173] WbemDefPath:IUnknown:AddRef (This=0x59061c0) returned 0x3 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4878) returned 0x0 [0332.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4878, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.174] WbemDefPath:IUnknown:Release (This=0x58f4878) returned 0x3 [0332.174] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.174] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.174] WbemDefPath:IUnknown:Release (This=0x59061c0) returned 0x2 [0332.174] WbemDefPath:IUnknown:Release (This=0x59061c0) returned 0x1 [0332.174] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.174] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x59061c0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59061c0) returned 0x0 [0332.174] WbemDefPath:IUnknown:AddRef (This=0x59061c0) returned 0x3 [0332.174] WbemDefPath:IUnknown:Release (This=0x59061c0) returned 0x2 [0332.175] WbemDefPath:IWbemPath:SetText (This=0x59061c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3968\"") returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.175] IWbemClassObject:Get (in: This=0x58fd700, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8ed0*=0, plFlavor=0x23a8ed4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x23a8ed0*=19, plFlavor=0x23a8ed4*=0) returned 0x0 [0332.175] IWbemClassObject:Get (in: This=0x58fd700, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8ed0*=19, plFlavor=0x23a8ed4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf80, varVal2=0x0), pType=0x23a8ed0*=19, plFlavor=0x23a8ed4*=0) returned 0x0 [0332.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.176] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.176] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.176] IWbemClassObject:Get (in: This=0x58fd700, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8fd4*=0, plFlavor=0x23a8fd8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x23a8fd4*=8, plFlavor=0x23a8fd8*=0) returned 0x0 [0332.176] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0332.176] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0332.176] IWbemClassObject:Get (in: This=0x58fd700, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a8fd4*=8, plFlavor=0x23a8fd8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="centralcreditcard.exe", varVal2=0x0), pType=0x23a8fd4*=8, plFlavor=0x23a8fd8*=0) returned 0x0 [0332.176] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0332.176] SysStringByteLen (bstr="centralcreditcard.exe") returned 0x2a [0332.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.176] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.176] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.177] IWbemClassObject:Get (in: This=0x58fd700, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9138*=0, plFlavor=0x23a913c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ", varVal2=0x0), pType=0x23a9138*=8, plFlavor=0x23a913c*=0) returned 0x0 [0332.177] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0332.177] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0332.177] IWbemClassObject:Get (in: This=0x58fd700, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9138*=8, plFlavor=0x23a913c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ", varVal2=0x0), pType=0x23a9138*=8, plFlavor=0x23a913c*=0) returned 0x0 [0332.177] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0332.177] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Defender\\centralcreditcard.exe\" ") returned 0x74 [0332.177] CoTaskMemAlloc (cb=0x4) returned 0x586b490 [0332.177] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b490, puReturned=0x2377db0 | out: apObjects=0x586b490*=0x5909408, puReturned=0x2377db0*=0x1) returned 0x0 [0332.180] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5909408) returned 0x0 [0332.180] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.181] IUnknown:AddRef (This=0x5909408) returned 0x3 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590940c) returned 0x0 [0332.181] IMarshal:GetUnmarshalClass (in: This=0x590940c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.181] IUnknown:Release (This=0x590940c) returned 0x3 [0332.181] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.181] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.181] IUnknown:QueryInterface (in: This=0x5909408, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.182] IUnknown:Release (This=0x5909408) returned 0x2 [0332.182] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.182] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.182] IUnknown:QueryInterface (in: This=0x5909408, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5909408) returned 0x0 [0332.182] IUnknown:AddRef (This=0x5909408) returned 0x4 [0332.182] IUnknown:Release (This=0x5909408) returned 0x3 [0332.182] IUnknown:Release (This=0x5909408) returned 0x2 [0332.182] CoTaskMemFree (pv=0x586b490) [0332.182] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.182] IUnknown:AddRef (This=0x5909408) returned 0x3 [0332.182] IWbemClassObject:Get (in: This=0x5909408, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.182] IWbemClassObject:Get (in: This=0x5909408, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.183] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0332.183] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x5e [0332.183] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.184] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.184] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.184] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.185] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0332.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.185] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905a50) returned 0x0 [0332.185] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0332.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905a50) returned 0x0 [0332.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.186] WbemDefPath:IUnknown:AddRef (This=0x5905a50) returned 0x3 [0332.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4de8) returned 0x0 [0332.186] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4de8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.186] WbemDefPath:IUnknown:Release (This=0x58f4de8) returned 0x3 [0332.186] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.186] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.186] WbemDefPath:IUnknown:Release (This=0x5905a50) returned 0x2 [0332.186] WbemDefPath:IUnknown:Release (This=0x5905a50) returned 0x1 [0332.186] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.186] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905a50, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905a50) returned 0x0 [0332.187] WbemDefPath:IUnknown:AddRef (This=0x5905a50) returned 0x3 [0332.187] WbemDefPath:IUnknown:Release (This=0x5905a50) returned 0x2 [0332.242] WbemDefPath:IWbemPath:SetText (This=0x5905a50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3984\"") returned 0x0 [0332.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.242] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.243] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.243] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.243] IWbemClassObject:Get (in: This=0x5909408, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9bd0*=0, plFlavor=0x23a9bd4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x23a9bd0*=19, plFlavor=0x23a9bd4*=0) returned 0x0 [0332.243] IWbemClassObject:Get (in: This=0x5909408, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9bd0*=19, plFlavor=0x23a9bd4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf90, varVal2=0x0), pType=0x23a9bd0*=19, plFlavor=0x23a9bd4*=0) returned 0x0 [0332.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.243] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.243] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.243] IWbemClassObject:Get (in: This=0x5909408, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9cd4*=0, plFlavor=0x23a9cd8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x23a9cd4*=8, plFlavor=0x23a9cd8*=0) returned 0x0 [0332.243] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0332.243] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0332.243] IWbemClassObject:Get (in: This=0x5909408, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9cd4*=8, plFlavor=0x23a9cd8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="creditservice.exe", varVal2=0x0), pType=0x23a9cd4*=8, plFlavor=0x23a9cd8*=0) returned 0x0 [0332.244] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0332.244] SysStringByteLen (bstr="creditservice.exe") returned 0x22 [0332.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.244] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.244] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.244] IWbemClassObject:Get (in: This=0x5909408, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9e28*=0, plFlavor=0x23a9e2c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ", varVal2=0x0), pType=0x23a9e28*=8, plFlavor=0x23a9e2c*=0) returned 0x0 [0332.244] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0332.244] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0332.244] IWbemClassObject:Get (in: This=0x5909408, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23a9e28*=8, plFlavor=0x23a9e2c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ", varVal2=0x0), pType=0x23a9e28*=8, plFlavor=0x23a9e2c*=0) returned 0x0 [0332.244] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0332.244] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft SQL Server\\creditservice.exe\" ") returned 0x74 [0332.245] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.245] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x5908f40, puReturned=0x2377db0*=0x1) returned 0x0 [0332.247] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5908f40) returned 0x0 [0332.247] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.247] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.247] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.247] IUnknown:AddRef (This=0x5908f40) returned 0x3 [0332.247] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.248] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.248] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x5908f44) returned 0x0 [0332.248] IMarshal:GetUnmarshalClass (in: This=0x5908f44, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.248] IUnknown:Release (This=0x5908f44) returned 0x3 [0332.248] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.248] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.248] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.248] IUnknown:Release (This=0x5908f40) returned 0x2 [0332.248] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.248] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.248] IUnknown:QueryInterface (in: This=0x5908f40, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5908f40) returned 0x0 [0332.248] IUnknown:AddRef (This=0x5908f40) returned 0x4 [0332.249] IUnknown:Release (This=0x5908f40) returned 0x3 [0332.249] IUnknown:Release (This=0x5908f40) returned 0x2 [0332.249] CoTaskMemFree (pv=0x586b460) [0332.249] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.249] IUnknown:AddRef (This=0x5908f40) returned 0x3 [0332.249] IWbemClassObject:Get (in: This=0x5908f40, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.249] IWbemClassObject:Get (in: This=0x5908f40, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.249] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0332.250] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x5e [0332.250] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.250] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.250] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.250] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.251] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0332.251] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59062a0) returned 0x0 [0332.252] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0332.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59062a0) returned 0x0 [0332.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.253] WbemDefPath:IUnknown:AddRef (This=0x59062a0) returned 0x3 [0332.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f4d10) returned 0x0 [0332.253] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f4d10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.253] WbemDefPath:IUnknown:Release (This=0x58f4d10) returned 0x3 [0332.253] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.253] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.254] WbemDefPath:IUnknown:Release (This=0x59062a0) returned 0x2 [0332.254] WbemDefPath:IUnknown:Release (This=0x59062a0) returned 0x1 [0332.254] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.254] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x59062a0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59062a0) returned 0x0 [0332.254] WbemDefPath:IUnknown:AddRef (This=0x59062a0) returned 0x3 [0332.254] WbemDefPath:IUnknown:Release (This=0x59062a0) returned 0x2 [0332.254] WbemDefPath:IWbemPath:SetText (This=0x59062a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3992\"") returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.254] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.254] IWbemClassObject:Get (in: This=0x5908f40, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aa8b8*=0, plFlavor=0x23aa8bc*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf98, varVal2=0x0), pType=0x23aa8b8*=19, plFlavor=0x23aa8bc*=0) returned 0x0 [0332.255] IWbemClassObject:Get (in: This=0x5908f40, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aa8b8*=19, plFlavor=0x23aa8bc*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf98, varVal2=0x0), pType=0x23aa8b8*=19, plFlavor=0x23aa8bc*=0) returned 0x0 [0332.255] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.255] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.255] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.255] IWbemClassObject:Get (in: This=0x5908f40, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aa9bc*=0, plFlavor=0x23aa9c0*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x23aa9bc*=8, plFlavor=0x23aa9c0*=0) returned 0x0 [0332.255] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0332.255] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0332.256] IWbemClassObject:Get (in: This=0x5908f40, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aa9bc*=8, plFlavor=0x23aa9c0*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="edcsvr.exe", varVal2=0x0), pType=0x23aa9bc*=8, plFlavor=0x23aa9c0*=0) returned 0x0 [0332.256] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0332.256] SysStringByteLen (bstr="edcsvr.exe") returned 0x14 [0332.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.256] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.256] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.256] IWbemClassObject:Get (in: This=0x5908f40, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aaaf8*=0, plFlavor=0x23aaafc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ", varVal2=0x0), pType=0x23aaaf8*=8, plFlavor=0x23aaafc*=0) returned 0x0 [0332.256] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0332.256] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0332.256] IWbemClassObject:Get (in: This=0x5908f40, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aaaf8*=8, plFlavor=0x23aaafc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ", varVal2=0x0), pType=0x23aaaf8*=8, plFlavor=0x23aaafc*=0) returned 0x0 [0332.256] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0332.257] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Microsoft SQL Server\\edcsvr.exe\" ") returned 0x72 [0332.257] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.257] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x59090d8, puReturned=0x2377db0*=0x1) returned 0x0 [0332.319] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x59090d8) returned 0x0 [0332.319] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.319] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.320] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.320] IUnknown:AddRef (This=0x59090d8) returned 0x3 [0332.320] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.320] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.320] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x59090dc) returned 0x0 [0332.320] IMarshal:GetUnmarshalClass (in: This=0x59090dc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.320] IUnknown:Release (This=0x59090dc) returned 0x3 [0332.320] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.320] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.320] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.321] IUnknown:Release (This=0x59090d8) returned 0x2 [0332.321] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.321] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.321] IUnknown:QueryInterface (in: This=0x59090d8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x59090d8) returned 0x0 [0332.321] IUnknown:AddRef (This=0x59090d8) returned 0x4 [0332.321] IUnknown:Release (This=0x59090d8) returned 0x3 [0332.321] IUnknown:Release (This=0x59090d8) returned 0x2 [0332.321] CoTaskMemFree (pv=0x586b460) [0332.321] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.321] IUnknown:AddRef (This=0x59090d8) returned 0x3 [0332.321] IWbemClassObject:Get (in: This=0x59090d8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.322] IWbemClassObject:Get (in: This=0x59090d8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.322] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0332.322] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x5e [0332.322] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.322] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.322] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.322] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.324] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.324] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905970) returned 0x0 [0332.324] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905970) returned 0x0 [0332.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.325] WbemDefPath:IUnknown:AddRef (This=0x5905970) returned 0x3 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58f5070) returned 0x0 [0332.325] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58f5070, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.325] WbemDefPath:IUnknown:Release (This=0x58f5070) returned 0x3 [0332.325] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.325] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.325] WbemDefPath:IUnknown:Release (This=0x5905970) returned 0x2 [0332.325] WbemDefPath:IUnknown:Release (This=0x5905970) returned 0x1 [0332.325] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.325] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905970, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905970) returned 0x0 [0332.325] WbemDefPath:IUnknown:AddRef (This=0x5905970) returned 0x3 [0332.325] WbemDefPath:IUnknown:Release (This=0x5905970) returned 0x2 [0332.326] WbemDefPath:IWbemPath:SetText (This=0x5905970, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4004\"") returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.326] IWbemClassObject:Get (in: This=0x59090d8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab570*=0, plFlavor=0x23ab574*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x23ab570*=19, plFlavor=0x23ab574*=0) returned 0x0 [0332.326] IWbemClassObject:Get (in: This=0x59090d8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab570*=19, plFlavor=0x23ab574*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfa4, varVal2=0x0), pType=0x23ab570*=19, plFlavor=0x23ab574*=0) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.326] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.327] IWbemClassObject:Get (in: This=0x59090d8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab674*=0, plFlavor=0x23ab678*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x23ab674*=8, plFlavor=0x23ab678*=0) returned 0x0 [0332.327] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0332.327] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0332.327] IWbemClassObject:Get (in: This=0x59090d8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab674*=8, plFlavor=0x23ab678*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fpos.exe", varVal2=0x0), pType=0x23ab674*=8, plFlavor=0x23ab678*=0) returned 0x0 [0332.327] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0332.327] SysStringByteLen (bstr="fpos.exe") returned 0x10 [0332.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.327] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.327] IWbemClassObject:Get (in: This=0x59090d8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab7a8*=0, plFlavor=0x23ab7ac*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ", varVal2=0x0), pType=0x23ab7a8*=8, plFlavor=0x23ab7ac*=0) returned 0x0 [0332.328] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0332.328] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0332.328] IWbemClassObject:Get (in: This=0x59090d8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ab7a8*=8, plFlavor=0x23ab7ac*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ", varVal2=0x0), pType=0x23ab7a8*=8, plFlavor=0x23ab7ac*=0) returned 0x0 [0332.328] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0332.328] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\fpos.exe\" ") returned 0x68 [0332.328] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.328] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x5909270, puReturned=0x2377db0*=0x1) returned 0x0 [0332.330] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5909270) returned 0x0 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.331] IUnknown:AddRef (This=0x5909270) returned 0x3 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x5909274) returned 0x0 [0332.331] IMarshal:GetUnmarshalClass (in: This=0x5909274, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.331] IUnknown:Release (This=0x5909274) returned 0x3 [0332.331] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.331] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.331] IUnknown:QueryInterface (in: This=0x5909270, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.331] IUnknown:Release (This=0x5909270) returned 0x2 [0332.331] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.332] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.332] IUnknown:QueryInterface (in: This=0x5909270, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5909270) returned 0x0 [0332.332] IUnknown:AddRef (This=0x5909270) returned 0x4 [0332.332] IUnknown:Release (This=0x5909270) returned 0x3 [0332.332] IUnknown:Release (This=0x5909270) returned 0x2 [0332.332] CoTaskMemFree (pv=0x586b2e0) [0332.332] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.332] IUnknown:AddRef (This=0x5909270) returned 0x3 [0332.332] IWbemClassObject:Get (in: This=0x5909270, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.332] IWbemClassObject:Get (in: This=0x5909270, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.333] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0332.333] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x5e [0332.333] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.333] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.333] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.333] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.334] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0332.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.334] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905e40) returned 0x0 [0332.334] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0332.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905e40) returned 0x0 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.335] WbemDefPath:IUnknown:AddRef (This=0x5905e40) returned 0x3 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590c798) returned 0x0 [0332.335] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590c798, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.335] WbemDefPath:IUnknown:Release (This=0x590c798) returned 0x3 [0332.335] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.335] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.335] WbemDefPath:IUnknown:Release (This=0x5905e40) returned 0x2 [0332.336] WbemDefPath:IUnknown:Release (This=0x5905e40) returned 0x1 [0332.336] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.336] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905e40, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905e40) returned 0x0 [0332.336] WbemDefPath:IUnknown:AddRef (This=0x5905e40) returned 0x3 [0332.336] WbemDefPath:IUnknown:Release (This=0x5905e40) returned 0x2 [0332.336] WbemDefPath:IWbemPath:SetText (This=0x5905e40, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4020\"") returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.336] IWbemClassObject:Get (in: This=0x5909270, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac40c*=0, plFlavor=0x23ac410*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb4, varVal2=0x0), pType=0x23ac40c*=19, plFlavor=0x23ac410*=0) returned 0x0 [0332.336] IWbemClassObject:Get (in: This=0x5909270, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac40c*=19, plFlavor=0x23ac410*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfb4, varVal2=0x0), pType=0x23ac40c*=19, plFlavor=0x23ac410*=0) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.336] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.337] IWbemClassObject:Get (in: This=0x5909270, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac510*=0, plFlavor=0x23ac514*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x23ac510*=8, plFlavor=0x23ac514*=0) returned 0x0 [0332.337] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0332.337] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0332.337] IWbemClassObject:Get (in: This=0x5909270, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac510*=8, plFlavor=0x23ac514*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="isspos.exe", varVal2=0x0), pType=0x23ac510*=8, plFlavor=0x23ac514*=0) returned 0x0 [0332.337] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0332.337] SysStringByteLen (bstr="isspos.exe") returned 0x14 [0332.337] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.337] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.337] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.337] IWbemClassObject:Get (in: This=0x5909270, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac64c*=0, plFlavor=0x23ac650*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ", varVal2=0x0), pType=0x23ac64c*=8, plFlavor=0x23ac650*=0) returned 0x0 [0332.337] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0332.337] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0332.337] IWbemClassObject:Get (in: This=0x5909270, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ac64c*=8, plFlavor=0x23ac650*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ", varVal2=0x0), pType=0x23ac64c*=8, plFlavor=0x23ac650*=0) returned 0x0 [0332.337] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0332.338] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\isspos.exe\" ") returned 0x72 [0332.338] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.338] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x590a590, puReturned=0x2377db0*=0x1) returned 0x0 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x590a590) returned 0x0 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.339] IUnknown:AddRef (This=0x590a590) returned 0x3 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.339] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590a594) returned 0x0 [0332.339] IMarshal:GetUnmarshalClass (in: This=0x590a594, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.340] IUnknown:Release (This=0x590a594) returned 0x3 [0332.340] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.340] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.340] IUnknown:QueryInterface (in: This=0x590a590, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.340] IUnknown:Release (This=0x590a590) returned 0x2 [0332.340] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.340] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.340] IUnknown:QueryInterface (in: This=0x590a590, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x590a590) returned 0x0 [0332.340] IUnknown:AddRef (This=0x590a590) returned 0x4 [0332.340] IUnknown:Release (This=0x590a590) returned 0x3 [0332.340] IUnknown:Release (This=0x590a590) returned 0x2 [0332.340] CoTaskMemFree (pv=0x586b2e0) [0332.340] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.340] IUnknown:AddRef (This=0x590a590) returned 0x3 [0332.340] IWbemClassObject:Get (in: This=0x590a590, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.340] IWbemClassObject:Get (in: This=0x590a590, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.341] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0332.341] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x5e [0332.341] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.341] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.341] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.341] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.342] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b490) returned 0x0 [0332.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b490, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.342] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b490, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906310) returned 0x0 [0332.342] WbemDefPath:IUnknown:Release (This=0x586b490) returned 0x0 [0332.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906310) returned 0x0 [0332.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.343] WbemDefPath:IUnknown:AddRef (This=0x5906310) returned 0x3 [0332.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590c978) returned 0x0 [0332.343] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590c978, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.343] WbemDefPath:IUnknown:Release (This=0x590c978) returned 0x3 [0332.343] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.343] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.343] WbemDefPath:IUnknown:Release (This=0x5906310) returned 0x2 [0332.344] WbemDefPath:IUnknown:Release (This=0x5906310) returned 0x1 [0332.344] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.344] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906310, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906310) returned 0x0 [0332.344] WbemDefPath:IUnknown:AddRef (This=0x5906310) returned 0x3 [0332.344] WbemDefPath:IUnknown:Release (This=0x5906310) returned 0x2 [0332.344] WbemDefPath:IWbemPath:SetText (This=0x5906310, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4028\"") returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.344] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.344] IWbemClassObject:Get (in: This=0x590a590, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad0c4*=0, plFlavor=0x23ad0c8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x23ad0c4*=19, plFlavor=0x23ad0c8*=0) returned 0x0 [0332.344] IWbemClassObject:Get (in: This=0x590a590, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad0c4*=19, plFlavor=0x23ad0c8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfbc, varVal2=0x0), pType=0x23ad0c4*=19, plFlavor=0x23ad0c8*=0) returned 0x0 [0332.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.345] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.345] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.345] IWbemClassObject:Get (in: This=0x590a590, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad1c8*=0, plFlavor=0x23ad1cc*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x23ad1c8*=8, plFlavor=0x23ad1cc*=0) returned 0x0 [0332.345] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0332.345] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0332.345] IWbemClassObject:Get (in: This=0x590a590, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad1c8*=8, plFlavor=0x23ad1cc*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="mxslipstream.exe", varVal2=0x0), pType=0x23ad1c8*=8, plFlavor=0x23ad1cc*=0) returned 0x0 [0332.345] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0332.345] SysStringByteLen (bstr="mxslipstream.exe") returned 0x20 [0332.345] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.345] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.345] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.345] IWbemClassObject:Get (in: This=0x590a590, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad31c*=0, plFlavor=0x23ad320*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ", varVal2=0x0), pType=0x23ad31c*=8, plFlavor=0x23ad320*=0) returned 0x0 [0332.346] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0332.346] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0332.346] IWbemClassObject:Get (in: This=0x590a590, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ad31c*=8, plFlavor=0x23ad320*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ", varVal2=0x0), pType=0x23ad31c*=8, plFlavor=0x23ad320*=0) returned 0x0 [0332.346] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0332.346] SysStringByteLen (bstr="\"C:\\Program Files\\Microsoft Analysis Services\\mxslipstream.exe\" ") returned 0x80 [0332.346] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.346] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x590a3f8, puReturned=0x2377db0*=0x1) returned 0x0 [0332.402] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x590a3f8) returned 0x0 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.403] IUnknown:AddRef (This=0x590a3f8) returned 0x3 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.403] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590a3fc) returned 0x0 [0332.403] IMarshal:GetUnmarshalClass (in: This=0x590a3fc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.403] IUnknown:Release (This=0x590a3fc) returned 0x3 [0332.404] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.404] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.404] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.404] IUnknown:Release (This=0x590a3f8) returned 0x2 [0332.404] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.404] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.404] IUnknown:QueryInterface (in: This=0x590a3f8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x590a3f8) returned 0x0 [0332.404] IUnknown:AddRef (This=0x590a3f8) returned 0x4 [0332.404] IUnknown:Release (This=0x590a3f8) returned 0x3 [0332.404] IUnknown:Release (This=0x590a3f8) returned 0x2 [0332.404] CoTaskMemFree (pv=0x586b460) [0332.404] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.404] IUnknown:AddRef (This=0x590a3f8) returned 0x3 [0332.404] IWbemClassObject:Get (in: This=0x590a3f8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.405] IWbemClassObject:Get (in: This=0x590a3f8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.405] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0332.405] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x5e [0332.405] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.405] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.405] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.405] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.406] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0332.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.407] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906380) returned 0x0 [0332.410] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906380) returned 0x0 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.410] WbemDefPath:IUnknown:AddRef (This=0x5906380) returned 0x3 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.410] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590cc78) returned 0x0 [0332.410] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590cc78, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.410] WbemDefPath:IUnknown:Release (This=0x590cc78) returned 0x3 [0332.410] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.410] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.411] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x2 [0332.411] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x1 [0332.411] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.411] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.411] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906380) returned 0x0 [0332.411] WbemDefPath:IUnknown:AddRef (This=0x5906380) returned 0x3 [0332.411] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x2 [0332.411] WbemDefPath:IWbemPath:SetText (This=0x5906380, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4040\"") returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.411] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.411] IWbemClassObject:Get (in: This=0x590a3f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23addcc*=0, plFlavor=0x23addd0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc8, varVal2=0x0), pType=0x23addcc*=19, plFlavor=0x23addd0*=0) returned 0x0 [0332.411] IWbemClassObject:Get (in: This=0x590a3f8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23addcc*=19, plFlavor=0x23addd0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfc8, varVal2=0x0), pType=0x23addcc*=19, plFlavor=0x23addd0*=0) returned 0x0 [0332.412] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.412] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.412] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.412] IWbemClassObject:Get (in: This=0x590a3f8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aded0*=0, plFlavor=0x23aded4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x23aded0*=8, plFlavor=0x23aded4*=0) returned 0x0 [0332.412] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0332.412] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0332.412] IWbemClassObject:Get (in: This=0x590a3f8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aded0*=8, plFlavor=0x23aded4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="omnipos.exe", varVal2=0x0), pType=0x23aded0*=8, plFlavor=0x23aded4*=0) returned 0x0 [0332.412] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0332.412] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0332.412] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.412] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.412] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.412] IWbemClassObject:Get (in: This=0x590a3f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ae00c*=0, plFlavor=0x23ae010*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ", varVal2=0x0), pType=0x23ae00c*=8, plFlavor=0x23ae010*=0) returned 0x0 [0332.412] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0332.413] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0332.413] IWbemClassObject:Get (in: This=0x590a3f8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ae00c*=8, plFlavor=0x23ae010*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ", varVal2=0x0), pType=0x23ae00c*=8, plFlavor=0x23ae010*=0) returned 0x0 [0332.413] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0332.413] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Windows NT\\omnipos.exe\" ") returned 0x60 [0332.413] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0332.413] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x5908748, puReturned=0x2377db0*=0x1) returned 0x0 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5908748) returned 0x0 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.414] IUnknown:AddRef (This=0x5908748) returned 0x3 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.414] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590874c) returned 0x0 [0332.414] IMarshal:GetUnmarshalClass (in: This=0x590874c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.414] IUnknown:Release (This=0x590874c) returned 0x3 [0332.415] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.415] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.415] IUnknown:QueryInterface (in: This=0x5908748, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.415] IUnknown:Release (This=0x5908748) returned 0x2 [0332.415] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.415] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.415] IUnknown:QueryInterface (in: This=0x5908748, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5908748) returned 0x0 [0332.415] IUnknown:AddRef (This=0x5908748) returned 0x4 [0332.415] IUnknown:Release (This=0x5908748) returned 0x3 [0332.415] IUnknown:Release (This=0x5908748) returned 0x2 [0332.415] CoTaskMemFree (pv=0x586b340) [0332.415] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.415] IUnknown:AddRef (This=0x5908748) returned 0x3 [0332.415] IWbemClassObject:Get (in: This=0x5908748, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.415] IWbemClassObject:Get (in: This=0x5908748, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.415] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0332.415] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x5e [0332.416] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.416] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.416] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.416] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.417] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b2e0) returned 0x0 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b2e0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b2e0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59059e0) returned 0x0 [0332.417] WbemDefPath:IUnknown:Release (This=0x586b2e0) returned 0x0 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59059e0) returned 0x0 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.417] WbemDefPath:IUnknown:AddRef (This=0x59059e0) returned 0x3 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590cb70) returned 0x0 [0332.418] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590cb70, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.418] WbemDefPath:IUnknown:Release (This=0x590cb70) returned 0x3 [0332.418] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.418] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.418] WbemDefPath:IUnknown:Release (This=0x59059e0) returned 0x2 [0332.418] WbemDefPath:IUnknown:Release (This=0x59059e0) returned 0x1 [0332.418] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.418] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x59059e0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59059e0) returned 0x0 [0332.418] WbemDefPath:IUnknown:AddRef (This=0x59059e0) returned 0x3 [0332.418] WbemDefPath:IUnknown:Release (This=0x59059e0) returned 0x2 [0332.418] WbemDefPath:IWbemPath:SetText (This=0x59059e0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4056\"") returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.418] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.418] IWbemClassObject:Get (in: This=0x5908748, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aea54*=0, plFlavor=0x23aea58*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfd8, varVal2=0x0), pType=0x23aea54*=19, plFlavor=0x23aea58*=0) returned 0x0 [0332.418] IWbemClassObject:Get (in: This=0x5908748, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aea54*=19, plFlavor=0x23aea58*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfd8, varVal2=0x0), pType=0x23aea54*=19, plFlavor=0x23aea58*=0) returned 0x0 [0332.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.419] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.419] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.419] IWbemClassObject:Get (in: This=0x5908748, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aeb58*=0, plFlavor=0x23aeb5c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x23aeb58*=8, plFlavor=0x23aeb5c*=0) returned 0x0 [0332.419] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0332.419] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0332.419] IWbemClassObject:Get (in: This=0x5908748, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aeb58*=8, plFlavor=0x23aeb5c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x23aeb58*=8, plFlavor=0x23aeb5c*=0) returned 0x0 [0332.419] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0332.419] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0332.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.419] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.419] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.419] IWbemClassObject:Get (in: This=0x5908748, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aec94*=0, plFlavor=0x23aec98*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ", varVal2=0x0), pType=0x23aec94*=8, plFlavor=0x23aec98*=0) returned 0x0 [0332.419] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0332.419] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0332.419] IWbemClassObject:Get (in: This=0x5908748, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23aec94*=8, plFlavor=0x23aec98*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ", varVal2=0x0), pType=0x23aec94*=8, plFlavor=0x23aec98*=0) returned 0x0 [0332.419] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0332.420] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\MSBuild\\spcwin.exe\" ") returned 0x58 [0332.420] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.420] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x59095a0, puReturned=0x2377db0*=0x1) returned 0x0 [0332.425] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x59095a0) returned 0x0 [0332.425] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.425] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.425] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.426] IUnknown:AddRef (This=0x59095a0) returned 0x3 [0332.426] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.426] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.426] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x59095a4) returned 0x0 [0332.426] IMarshal:GetUnmarshalClass (in: This=0x59095a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.426] IUnknown:Release (This=0x59095a4) returned 0x3 [0332.426] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.426] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.426] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.426] IUnknown:Release (This=0x59095a0) returned 0x2 [0332.426] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.426] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.426] IUnknown:QueryInterface (in: This=0x59095a0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x59095a0) returned 0x0 [0332.426] IUnknown:AddRef (This=0x59095a0) returned 0x4 [0332.426] IUnknown:Release (This=0x59095a0) returned 0x3 [0332.426] IUnknown:Release (This=0x59095a0) returned 0x2 [0332.426] CoTaskMemFree (pv=0x586b2e0) [0332.426] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.426] IUnknown:AddRef (This=0x59095a0) returned 0x3 [0332.426] IWbemClassObject:Get (in: This=0x59095a0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.427] IWbemClassObject:Get (in: This=0x59095a0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.427] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0332.427] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x5e [0332.427] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.427] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.427] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.427] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.428] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0332.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.428] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905d60) returned 0x0 [0332.428] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0332.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905d60) returned 0x0 [0332.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.428] WbemDefPath:IUnknown:AddRef (This=0x5905d60) returned 0x3 [0332.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590cf60) returned 0x0 [0332.429] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590cf60, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.429] WbemDefPath:IUnknown:Release (This=0x590cf60) returned 0x3 [0332.429] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.429] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.429] WbemDefPath:IUnknown:Release (This=0x5905d60) returned 0x2 [0332.429] WbemDefPath:IUnknown:Release (This=0x5905d60) returned 0x1 [0332.429] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.429] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905d60, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905d60) returned 0x0 [0332.429] WbemDefPath:IUnknown:AddRef (This=0x5905d60) returned 0x3 [0332.429] WbemDefPath:IUnknown:Release (This=0x5905d60) returned 0x2 [0332.429] WbemDefPath:IWbemPath:SetText (This=0x5905d60, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4064\"") returned 0x0 [0332.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.429] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.429] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.429] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.430] IWbemClassObject:Get (in: This=0x59095a0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af6c0*=0, plFlavor=0x23af6c4*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe0, varVal2=0x0), pType=0x23af6c0*=19, plFlavor=0x23af6c4*=0) returned 0x0 [0332.430] IWbemClassObject:Get (in: This=0x59095a0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af6c0*=19, plFlavor=0x23af6c4*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfe0, varVal2=0x0), pType=0x23af6c0*=19, plFlavor=0x23af6c4*=0) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.430] IWbemClassObject:Get (in: This=0x59095a0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af7c4*=0, plFlavor=0x23af7c8*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x23af7c4*=8, plFlavor=0x23af7c8*=0) returned 0x0 [0332.430] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0332.430] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0332.430] IWbemClassObject:Get (in: This=0x59095a0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af7c4*=8, plFlavor=0x23af7c8*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x23af7c4*=8, plFlavor=0x23af7c8*=0) returned 0x0 [0332.430] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0332.430] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0332.430] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.430] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.431] IWbemClassObject:Get (in: This=0x59095a0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af920*=0, plFlavor=0x23af924*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ", varVal2=0x0), pType=0x23af920*=8, plFlavor=0x23af924*=0) returned 0x0 [0332.431] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0332.431] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0332.431] IWbemClassObject:Get (in: This=0x59095a0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23af920*=8, plFlavor=0x23af924*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ", varVal2=0x0), pType=0x23af920*=8, plFlavor=0x23af924*=0) returned 0x0 [0332.431] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0332.431] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Reference Assemblies\\spgagentservice.exe\" ") returned 0x84 [0332.431] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.431] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x590a0c8, puReturned=0x2377db0*=0x1) returned 0x0 [0332.433] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x590a0c8) returned 0x0 [0332.433] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.433] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.433] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.434] IUnknown:AddRef (This=0x590a0c8) returned 0x3 [0332.434] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.434] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.434] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590a0cc) returned 0x0 [0332.434] IMarshal:GetUnmarshalClass (in: This=0x590a0cc, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.434] IUnknown:Release (This=0x590a0cc) returned 0x3 [0332.434] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.434] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.434] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.434] IUnknown:Release (This=0x590a0c8) returned 0x2 [0332.434] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.434] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.434] IUnknown:QueryInterface (in: This=0x590a0c8, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x590a0c8) returned 0x0 [0332.435] IUnknown:AddRef (This=0x590a0c8) returned 0x4 [0332.435] IUnknown:Release (This=0x590a0c8) returned 0x3 [0332.435] IUnknown:Release (This=0x590a0c8) returned 0x2 [0332.435] CoTaskMemFree (pv=0x586b2e0) [0332.435] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.435] IUnknown:AddRef (This=0x590a0c8) returned 0x3 [0332.435] IWbemClassObject:Get (in: This=0x590a0c8, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.435] IWbemClassObject:Get (in: This=0x590a0c8, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.435] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0332.435] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x5e [0332.435] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.435] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.435] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.435] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.436] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b340) returned 0x0 [0332.436] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b340, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.436] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b340, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59063f0) returned 0x0 [0332.440] WbemDefPath:IUnknown:Release (This=0x586b340) returned 0x0 [0332.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59063f0) returned 0x0 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.441] WbemDefPath:IUnknown:AddRef (This=0x59063f0) returned 0x3 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590cfa8) returned 0x0 [0332.441] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590cfa8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.441] WbemDefPath:IUnknown:Release (This=0x590cfa8) returned 0x3 [0332.441] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.441] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.442] WbemDefPath:IUnknown:Release (This=0x59063f0) returned 0x2 [0332.442] WbemDefPath:IUnknown:Release (This=0x59063f0) returned 0x1 [0332.442] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.442] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x59063f0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59063f0) returned 0x0 [0332.442] WbemDefPath:IUnknown:AddRef (This=0x59063f0) returned 0x3 [0332.442] WbemDefPath:IUnknown:Release (This=0x59063f0) returned 0x2 [0332.442] WbemDefPath:IWbemPath:SetText (This=0x59063f0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4076\"") returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.442] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.442] IWbemClassObject:Get (in: This=0x590a0c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b03e4*=0, plFlavor=0x23b03e8*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfec, varVal2=0x0), pType=0x23b03e4*=19, plFlavor=0x23b03e8*=0) returned 0x0 [0332.442] IWbemClassObject:Get (in: This=0x590a0c8, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b03e4*=19, plFlavor=0x23b03e8*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xfec, varVal2=0x0), pType=0x23b03e4*=19, plFlavor=0x23b03e8*=0) returned 0x0 [0332.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.443] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.443] IWbemClassObject:Get (in: This=0x590a0c8, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b04e8*=0, plFlavor=0x23b04ec*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23b04e8*=8, plFlavor=0x23b04ec*=0) returned 0x0 [0332.443] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0332.443] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0332.443] IWbemClassObject:Get (in: This=0x590a0c8, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b04e8*=8, plFlavor=0x23b04ec*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23b04e8*=8, plFlavor=0x23b04ec*=0) returned 0x0 [0332.443] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0332.443] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0332.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.444] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.444] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.444] IWbemClassObject:Get (in: This=0x590a0c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b061c*=0, plFlavor=0x23b0620*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ", varVal2=0x0), pType=0x23b061c*=8, plFlavor=0x23b0620*=0) returned 0x0 [0332.444] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0332.444] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0332.445] IWbemClassObject:Get (in: This=0x590a0c8, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b061c*=8, plFlavor=0x23b0620*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ", varVal2=0x0), pType=0x23b061c*=8, plFlavor=0x23b0620*=0) returned 0x0 [0332.445] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0332.445] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Media Player\\utg2.exe\" ") returned 0x62 [0332.445] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.445] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x5909d98, puReturned=0x2377db0*=0x1) returned 0x0 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5909d98) returned 0x0 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.460] IUnknown:AddRef (This=0x5909d98) returned 0x3 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.460] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x5909d9c) returned 0x0 [0332.461] IMarshal:GetUnmarshalClass (in: This=0x5909d9c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.461] IUnknown:Release (This=0x5909d9c) returned 0x3 [0332.461] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.461] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.461] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.461] IUnknown:Release (This=0x5909d98) returned 0x2 [0332.461] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.461] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.461] IUnknown:QueryInterface (in: This=0x5909d98, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5909d98) returned 0x0 [0332.461] IUnknown:AddRef (This=0x5909d98) returned 0x4 [0332.461] IUnknown:Release (This=0x5909d98) returned 0x3 [0332.461] IUnknown:Release (This=0x5909d98) returned 0x2 [0332.461] CoTaskMemFree (pv=0x586b2e0) [0332.461] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.462] IUnknown:AddRef (This=0x5909d98) returned 0x3 [0332.462] IWbemClassObject:Get (in: This=0x5909d98, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.462] IWbemClassObject:Get (in: This=0x5909d98, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.462] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0332.462] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x5e [0332.462] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.462] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.462] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.462] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.463] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.464] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905c10) returned 0x0 [0332.464] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905c10) returned 0x0 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.464] WbemDefPath:IUnknown:AddRef (This=0x5905c10) returned 0x3 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590d1a0) returned 0x0 [0332.464] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590d1a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.464] WbemDefPath:IUnknown:Release (This=0x590d1a0) returned 0x3 [0332.464] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.465] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.465] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x2 [0332.465] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x1 [0332.465] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.465] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905c10) returned 0x0 [0332.465] WbemDefPath:IUnknown:AddRef (This=0x5905c10) returned 0x3 [0332.465] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x2 [0332.465] WbemDefPath:IWbemPath:SetText (This=0x5905c10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4088\"") returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.465] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.465] IWbemClassObject:Get (in: This=0x5909d98, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1060*=0, plFlavor=0x23b1064*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff8, varVal2=0x0), pType=0x23b1060*=19, plFlavor=0x23b1064*=0) returned 0x0 [0332.466] IWbemClassObject:Get (in: This=0x5909d98, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1060*=19, plFlavor=0x23b1064*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff8, varVal2=0x0), pType=0x23b1060*=19, plFlavor=0x23b1064*=0) returned 0x0 [0332.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.466] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.466] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.466] IWbemClassObject:Get (in: This=0x5909d98, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1164*=0, plFlavor=0x23b1168*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x23b1164*=8, plFlavor=0x23b1168*=0) returned 0x0 [0332.466] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0332.466] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0332.466] IWbemClassObject:Get (in: This=0x5909d98, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1164*=8, plFlavor=0x23b1168*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="morethuslaw.exe", varVal2=0x0), pType=0x23b1164*=8, plFlavor=0x23b1168*=0) returned 0x0 [0332.466] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0332.466] SysStringByteLen (bstr="morethuslaw.exe") returned 0x1e [0332.466] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.466] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.466] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.467] IWbemClassObject:Get (in: This=0x5909d98, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b12b0*=0, plFlavor=0x23b12b4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ", varVal2=0x0), pType=0x23b12b0*=8, plFlavor=0x23b12b4*=0) returned 0x0 [0332.467] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0332.467] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0332.467] IWbemClassObject:Get (in: This=0x5909d98, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b12b0*=8, plFlavor=0x23b12b4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ", varVal2=0x0), pType=0x23b12b0*=8, plFlavor=0x23b12b4*=0) returned 0x0 [0332.467] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0332.467] SysStringByteLen (bstr="\"C:\\Program Files\\Windows Photo Viewer\\morethuslaw.exe\" ") returned 0x70 [0332.467] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.467] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x59088e0, puReturned=0x2377db0*=0x1) returned 0x0 [0332.472] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x59088e0) returned 0x0 [0332.472] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.472] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.472] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.473] IUnknown:AddRef (This=0x59088e0) returned 0x3 [0332.473] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.473] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.473] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x59088e4) returned 0x0 [0332.473] IMarshal:GetUnmarshalClass (in: This=0x59088e4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.473] IUnknown:Release (This=0x59088e4) returned 0x3 [0332.473] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.473] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.473] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.473] IUnknown:Release (This=0x59088e0) returned 0x2 [0332.473] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.473] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.473] IUnknown:QueryInterface (in: This=0x59088e0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x59088e0) returned 0x0 [0332.473] IUnknown:AddRef (This=0x59088e0) returned 0x4 [0332.473] IUnknown:Release (This=0x59088e0) returned 0x3 [0332.473] IUnknown:Release (This=0x59088e0) returned 0x2 [0332.474] CoTaskMemFree (pv=0x586b460) [0332.474] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.474] IUnknown:AddRef (This=0x59088e0) returned 0x3 [0332.474] IWbemClassObject:Get (in: This=0x59088e0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.474] IWbemClassObject:Get (in: This=0x59088e0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.474] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0332.474] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x5c [0332.474] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.474] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.474] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.474] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.475] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.476] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906460) returned 0x0 [0332.476] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906460) returned 0x0 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.476] WbemDefPath:IUnknown:AddRef (This=0x5906460) returned 0x3 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590d338) returned 0x0 [0332.476] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590d338, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.476] WbemDefPath:IUnknown:Release (This=0x590d338) returned 0x3 [0332.476] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.477] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.477] WbemDefPath:IUnknown:Release (This=0x5906460) returned 0x2 [0332.477] WbemDefPath:IUnknown:Release (This=0x5906460) returned 0x1 [0332.477] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.477] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906460, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5906460) returned 0x0 [0332.477] WbemDefPath:IUnknown:AddRef (This=0x5906460) returned 0x3 [0332.477] WbemDefPath:IUnknown:Release (This=0x5906460) returned 0x2 [0332.477] WbemDefPath:IWbemPath:SetText (This=0x5906460, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"460\"") returned 0x0 [0332.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.477] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.477] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.477] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.478] IWbemClassObject:Get (in: This=0x59088e0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1d30*=0, plFlavor=0x23b1d34*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1cc, varVal2=0x0), pType=0x23b1d30*=19, plFlavor=0x23b1d34*=0) returned 0x0 [0332.478] IWbemClassObject:Get (in: This=0x59088e0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1d30*=19, plFlavor=0x23b1d34*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1cc, varVal2=0x0), pType=0x23b1d30*=19, plFlavor=0x23b1d34*=0) returned 0x0 [0332.478] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.478] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.478] IWbemClassObject:Get (in: This=0x59088e0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1e30*=0, plFlavor=0x23b1e34*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x23b1e30*=8, plFlavor=0x23b1e34*=0) returned 0x0 [0332.478] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0332.478] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0332.479] IWbemClassObject:Get (in: This=0x59088e0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1e30*=8, plFlavor=0x23b1e34*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fingerfailnext.exe", varVal2=0x0), pType=0x23b1e30*=8, plFlavor=0x23b1e34*=0) returned 0x0 [0332.479] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0332.479] SysStringByteLen (bstr="fingerfailnext.exe") returned 0x24 [0332.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.479] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.479] IWbemClassObject:Get (in: This=0x59088e0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1f8c*=0, plFlavor=0x23b1f90*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ", varVal2=0x0), pType=0x23b1f8c*=8, plFlavor=0x23b1f90*=0) returned 0x0 [0332.479] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0332.479] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0332.479] IWbemClassObject:Get (in: This=0x59088e0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b1f8c*=8, plFlavor=0x23b1f90*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ", varVal2=0x0), pType=0x23b1f8c*=8, plFlavor=0x23b1f90*=0) returned 0x0 [0332.479] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0332.479] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\WindowsPowerShell\\fingerfailnext.exe\" ") returned 0x7c [0332.480] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.480] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x5908a78, puReturned=0x2377db0*=0x1) returned 0x0 [0332.481] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5908a78) returned 0x0 [0332.481] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.481] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.481] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.482] IUnknown:AddRef (This=0x5908a78) returned 0x3 [0332.482] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.482] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.482] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x5908a7c) returned 0x0 [0332.482] IMarshal:GetUnmarshalClass (in: This=0x5908a7c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.482] IUnknown:Release (This=0x5908a7c) returned 0x3 [0332.482] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.482] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.482] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.482] IUnknown:Release (This=0x5908a78) returned 0x2 [0332.482] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.482] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.482] IUnknown:QueryInterface (in: This=0x5908a78, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5908a78) returned 0x0 [0332.482] IUnknown:AddRef (This=0x5908a78) returned 0x4 [0332.482] IUnknown:Release (This=0x5908a78) returned 0x3 [0332.482] IUnknown:Release (This=0x5908a78) returned 0x2 [0332.483] CoTaskMemFree (pv=0x586b460) [0332.483] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.483] IUnknown:AddRef (This=0x5908a78) returned 0x3 [0332.483] IWbemClassObject:Get (in: This=0x5908a78, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.483] IWbemClassObject:Get (in: This=0x5908a78, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.483] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0332.483] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0332.483] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.484] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.485] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.485] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.489] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.489] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x59064d0) returned 0x0 [0332.489] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x59064d0) returned 0x0 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.489] WbemDefPath:IUnknown:AddRef (This=0x59064d0) returned 0x3 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590d380) returned 0x0 [0332.490] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590d380, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.490] WbemDefPath:IUnknown:Release (This=0x590d380) returned 0x3 [0332.490] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.490] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.490] WbemDefPath:IUnknown:Release (This=0x59064d0) returned 0x2 [0332.490] WbemDefPath:IUnknown:Release (This=0x59064d0) returned 0x1 [0332.490] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.490] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x59064d0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x59064d0) returned 0x0 [0332.490] WbemDefPath:IUnknown:AddRef (This=0x59064d0) returned 0x3 [0332.490] WbemDefPath:IUnknown:Release (This=0x59064d0) returned 0x2 [0332.490] WbemDefPath:IWbemPath:SetText (This=0x59064d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x0 [0332.490] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.490] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.490] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.490] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.491] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.491] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.491] IWbemClassObject:Get (in: This=0x5908a78, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2a34*=0, plFlavor=0x23b2a38*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x110c, varVal2=0x0), pType=0x23b2a34*=19, plFlavor=0x23b2a38*=0) returned 0x0 [0332.491] IWbemClassObject:Get (in: This=0x5908a78, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2a34*=19, plFlavor=0x23b2a38*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x110c, varVal2=0x0), pType=0x23b2a34*=19, plFlavor=0x23b2a38*=0) returned 0x0 [0332.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.491] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.491] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.491] IWbemClassObject:Get (in: This=0x5908a78, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2b38*=0, plFlavor=0x23b2b3c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23b2b38*=8, plFlavor=0x23b2b3c*=0) returned 0x0 [0332.491] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0332.491] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0332.492] IWbemClassObject:Get (in: This=0x5908a78, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2b38*=8, plFlavor=0x23b2b3c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23b2b38*=8, plFlavor=0x23b2b3c*=0) returned 0x0 [0332.492] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0332.492] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0332.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.492] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.492] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.492] IWbemClassObject:Get (in: This=0x5908a78, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2c7c*=0, plFlavor=0x23b2c80*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x23b2c7c*=8, plFlavor=0x23b2c80*=0) returned 0x0 [0332.492] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0332.492] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0332.492] IWbemClassObject:Get (in: This=0x5908a78, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b2c7c*=8, plFlavor=0x23b2c80*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2", varVal2=0x0), pType=0x23b2c7c*=8, plFlavor=0x23b2c80*=0) returned 0x0 [0332.493] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0332.493] SysStringByteLen (bstr="\"C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE\" SCODEF:2220 CREDAT:82945 /prefetch:2") returned 0xb8 [0332.493] CoTaskMemAlloc (cb=0x4) returned 0x586b340 [0332.493] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b340, puReturned=0x2377db0 | out: apObjects=0x586b340*=0x5909738, puReturned=0x2377db0*=0x1) returned 0x0 [0332.494] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x5909738) returned 0x0 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.495] IUnknown:AddRef (This=0x5909738) returned 0x3 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.495] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x590973c) returned 0x0 [0332.495] IMarshal:GetUnmarshalClass (in: This=0x590973c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.495] IUnknown:Release (This=0x590973c) returned 0x3 [0332.495] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.495] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.496] IUnknown:QueryInterface (in: This=0x5909738, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.496] IUnknown:Release (This=0x5909738) returned 0x2 [0332.496] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.496] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.496] IUnknown:QueryInterface (in: This=0x5909738, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x5909738) returned 0x0 [0332.496] IUnknown:AddRef (This=0x5909738) returned 0x4 [0332.496] IUnknown:Release (This=0x5909738) returned 0x3 [0332.496] IUnknown:Release (This=0x5909738) returned 0x2 [0332.496] CoTaskMemFree (pv=0x586b340) [0332.496] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.496] IUnknown:AddRef (This=0x5909738) returned 0x3 [0332.496] IWbemClassObject:Get (in: This=0x5909738, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.497] IWbemClassObject:Get (in: This=0x5909738, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.497] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0332.497] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x5e [0332.497] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.497] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.497] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.497] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.498] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.498] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.498] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905ba0) returned 0x0 [0332.498] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905ba0) returned 0x0 [0332.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.499] WbemDefPath:IUnknown:AddRef (This=0x5905ba0) returned 0x3 [0332.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590d6b0) returned 0x0 [0332.502] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590d6b0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.502] WbemDefPath:IUnknown:Release (This=0x590d6b0) returned 0x3 [0332.502] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.503] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.503] WbemDefPath:IUnknown:Release (This=0x5905ba0) returned 0x2 [0332.503] WbemDefPath:IUnknown:Release (This=0x5905ba0) returned 0x1 [0332.503] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.503] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905ba0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905ba0) returned 0x0 [0332.503] WbemDefPath:IUnknown:AddRef (This=0x5905ba0) returned 0x3 [0332.503] WbemDefPath:IUnknown:Release (This=0x5905ba0) returned 0x2 [0332.503] WbemDefPath:IWbemPath:SetText (This=0x5905ba0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4644\"") returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.503] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.503] IWbemClassObject:Get (in: This=0x5909738, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b37cc*=0, plFlavor=0x23b37d0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1224, varVal2=0x0), pType=0x23b37cc*=19, plFlavor=0x23b37d0*=0) returned 0x0 [0332.504] IWbemClassObject:Get (in: This=0x5909738, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b37cc*=19, plFlavor=0x23b37d0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1224, varVal2=0x0), pType=0x23b37cc*=19, plFlavor=0x23b37d0*=0) returned 0x0 [0332.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.504] IWbemClassObject:Get (in: This=0x5909738, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b38d0*=0, plFlavor=0x23b38d4*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x23b38d0*=8, plFlavor=0x23b38d4*=0) returned 0x0 [0332.504] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0332.504] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0332.504] IWbemClassObject:Get (in: This=0x5909738, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b38d0*=8, plFlavor=0x23b38d4*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conhost.exe", varVal2=0x0), pType=0x23b38d0*=8, plFlavor=0x23b38d4*=0) returned 0x0 [0332.504] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0332.504] SysStringByteLen (bstr="conhost.exe") returned 0x16 [0332.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.504] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.504] IWbemClassObject:Get (in: This=0x5909738, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b3a0c*=0, plFlavor=0x23b3a10*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\??\\C:\\Windows\\system32\\conhost.exe 0x4", varVal2=0x0), pType=0x23b3a0c*=8, plFlavor=0x23b3a10*=0) returned 0x0 [0332.504] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0332.504] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0332.505] IWbemClassObject:Get (in: This=0x5909738, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b3a0c*=8, plFlavor=0x23b3a10*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\??\\C:\\Windows\\system32\\conhost.exe 0x4", varVal2=0x0), pType=0x23b3a0c*=8, plFlavor=0x23b3a10*=0) returned 0x0 [0332.505] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0332.505] SysStringByteLen (bstr="\\??\\C:\\Windows\\system32\\conhost.exe 0x4") returned 0x4e [0332.505] CoTaskMemAlloc (cb=0x4) returned 0x586b2e0 [0332.505] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b2e0, puReturned=0x2377db0 | out: apObjects=0x586b2e0*=0x59098d0, puReturned=0x2377db0*=0x1) returned 0x0 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x59098d0) returned 0x0 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0332.508] IUnknown:AddRef (This=0x59098d0) returned 0x3 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0332.508] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x59098d4) returned 0x0 [0332.508] IMarshal:GetUnmarshalClass (in: This=0x59098d4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0332.508] IUnknown:Release (This=0x59098d4) returned 0x3 [0332.508] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0332.509] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0332.509] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0332.509] IUnknown:Release (This=0x59098d0) returned 0x2 [0332.509] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0332.509] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0332.509] IUnknown:QueryInterface (in: This=0x59098d0, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x59098d0) returned 0x0 [0332.509] IUnknown:AddRef (This=0x59098d0) returned 0x4 [0332.509] IUnknown:Release (This=0x59098d0) returned 0x3 [0332.509] IUnknown:Release (This=0x59098d0) returned 0x2 [0332.509] CoTaskMemFree (pv=0x586b2e0) [0332.509] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0332.509] IUnknown:AddRef (This=0x59098d0) returned 0x3 [0332.509] IWbemClassObject:Get (in: This=0x59098d0, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0332.509] IWbemClassObject:Get (in: This=0x59098d0, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0332.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0332.510] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x5e [0332.510] CoGetObjectContext (in: riid=0x2249f40*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0332.510] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0332.510] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249f28*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0332.510] IUnknown:Release (This=0x692bc4) returned 0x1 [0332.511] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x586b460) returned 0x0 [0332.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x586b460, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0332.511] WbemDefPath:IClassFactory:CreateInstance (in: This=0x586b460, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905cf0) returned 0x0 [0332.511] WbemDefPath:IUnknown:Release (This=0x586b460) returned 0x0 [0332.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905cf0) returned 0x0 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0332.512] WbemDefPath:IUnknown:AddRef (This=0x5905cf0) returned 0x3 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x590d6f8) returned 0x0 [0332.512] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x590d6f8, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0332.512] WbemDefPath:IUnknown:Release (This=0x590d6f8) returned 0x3 [0332.512] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0332.512] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0332.512] WbemDefPath:IUnknown:Release (This=0x5905cf0) returned 0x2 [0332.512] WbemDefPath:IUnknown:Release (This=0x5905cf0) returned 0x1 [0332.512] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0332.512] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0332.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905cf0, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905cf0) returned 0x0 [0332.512] WbemDefPath:IUnknown:AddRef (This=0x5905cf0) returned 0x3 [0332.513] WbemDefPath:IUnknown:Release (This=0x5905cf0) returned 0x2 [0332.513] WbemDefPath:IWbemPath:SetText (This=0x5905cf0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2768\"") returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.513] IWbemClassObject:Get (in: This=0x59098d0, wszName="ProcessId", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b4418*=0, plFlavor=0x23b441c*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xad0, varVal2=0x0), pType=0x23b4418*=19, plFlavor=0x23b441c*=0) returned 0x0 [0332.513] IWbemClassObject:Get (in: This=0x59098d0, wszName="ProcessId", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b4418*=19, plFlavor=0x23b441c*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xad0, varVal2=0x0), pType=0x23b4418*=19, plFlavor=0x23b441c*=0) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.513] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.513] IWbemClassObject:Get (in: This=0x59098d0, wszName="Name", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b451c*=0, plFlavor=0x23b4520*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x23b451c*=8, plFlavor=0x23b4520*=0) returned 0x0 [0332.513] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0332.513] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0332.514] IWbemClassObject:Get (in: This=0x59098d0, wszName="Name", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b451c*=8, plFlavor=0x23b4520*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSBuild.exe", varVal2=0x0), pType=0x23b451c*=8, plFlavor=0x23b4520*=0) returned 0x0 [0332.514] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0332.514] SysStringByteLen (bstr="MSBuild.exe") returned 0x16 [0332.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0332.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0332.514] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0332.514] IWbemClassObject:Get (in: This=0x59098d0, wszName="CommandLine", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b4658*=0, plFlavor=0x23b465c*=0 | out: pVal=0x18ebb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"", varVal2=0x0), pType=0x23b4658*=8, plFlavor=0x23b465c*=0) returned 0x0 [0332.514] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0332.514] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0332.514] IWbemClassObject:Get (in: This=0x59098d0, wszName="CommandLine", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23b4658*=8, plFlavor=0x23b465c*=0 | out: pVal=0x18ebb8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"", varVal2=0x0), pType=0x23b4658*=8, plFlavor=0x23b465c*=0) returned 0x0 [0332.514] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0332.514] SysStringByteLen (bstr="\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe\"") returned 0x76 [0332.514] CoTaskMemAlloc (cb=0x4) returned 0x586b460 [0332.515] IEnumWbemClassObject:Next (in: This=0x73bfa0, lTimeout=-1, uCount=0x1, apObjects=0x586b460, puReturned=0x2377db0 | out: apObjects=0x586b460*=0x0, puReturned=0x2377db0*=0x0) returned 0x1 [0332.516] CoTaskMemFree (pv=0x586b460) [0332.518] CoGetContextToken (in: pToken=0x18eae0 | out: pToken=0x18eae0) returned 0x0 [0332.518] WbemLocator:IUnknown:Release (This=0x6c2908) returned 0x1 [0332.519] IUnknown:Release (This=0x73bfa0) returned 0x0 [0332.522] CoGetContextToken (in: pToken=0x18eae0 | out: pToken=0x18eae0) returned 0x0 [0332.522] WbemLocator:IUnknown:Release (This=0x6c1c08) returned 0x1 [0332.522] IUnknown:Release (This=0x73c838) returned 0x0 [0332.691] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0332.692] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Desktop", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1e [0332.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.786] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.txt"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.790] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.doc*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.doc*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.790] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.790] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.791] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.rdp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.rdp"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.791] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.791] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.792] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.key*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.key*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.792] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.792] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.793] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*wallet*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*wallet*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.794] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*seed*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*seed*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.795] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*metamask*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*metamask*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0332.796] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x1e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0332.796] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*.lnk"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.803] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0332.803] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Documents", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x20 [0332.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.803] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.803] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.804] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.txt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.txt"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.804] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.805] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.doc*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.doc*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde61ace0, ftCreationTime.dwHighDateTime=0x1d9bd8a, ftLastAccessTime.dwLowDateTime=0xa848ffe0, ftLastAccessTime.dwHighDateTime=0x1d9c16e, ftLastWriteTime.dwLowDateTime=0xa848ffe0, ftLastWriteTime.dwHighDateTime=0x1d9c16e, nFileSizeHigh=0x0, nFileSizeLow=0xb4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Ea60w7-zI9o0_ xjIc.docx", cAlternateFileName="8EA60W~1.DOC")) returned 0x587bba0 [0332.806] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ecbd80, ftCreationTime.dwHighDateTime=0x1d9c5cc, ftLastAccessTime.dwLowDateTime=0xd23b69e0, ftLastAccessTime.dwHighDateTime=0x1da4a27, ftLastWriteTime.dwLowDateTime=0xd23b69e0, ftLastWriteTime.dwHighDateTime=0x1da4a27, nFileSizeHigh=0x0, nFileSizeLow=0x6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="AwW7QIFXglY7.docx", cAlternateFileName="AWW7QI~1.DOC")) returned 1 [0332.806] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c4e4f0, ftCreationTime.dwHighDateTime=0x1d9dc35, ftLastAccessTime.dwLowDateTime=0xfb8c9340, ftLastAccessTime.dwHighDateTime=0x1da1d64, ftLastWriteTime.dwLowDateTime=0xfb8c9340, ftLastWriteTime.dwHighDateTime=0x1da1d64, nFileSizeHigh=0x0, nFileSizeLow=0x16f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DlEaE5sSwl_9U8JCrDw.docx", cAlternateFileName="DLEAE5~1.DOC")) returned 1 [0332.806] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe358df90, ftCreationTime.dwHighDateTime=0x1d9f0f0, ftLastAccessTime.dwLowDateTime=0x8c9c5d30, ftLastAccessTime.dwHighDateTime=0x1da42c1, ftLastWriteTime.dwLowDateTime=0x8c9c5d30, ftLastWriteTime.dwHighDateTime=0x1da42c1, nFileSizeHigh=0x0, nFileSizeLow=0x13c0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="dLWgCFWWoUsi1.docx", cAlternateFileName="DLWGCF~1.DOC")) returned 1 [0332.806] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4faf32e0, ftCreationTime.dwHighDateTime=0x1da3bcc, ftLastAccessTime.dwLowDateTime=0x62d62410, ftLastAccessTime.dwHighDateTime=0x1da3cb1, ftLastWriteTime.dwLowDateTime=0x62d62410, ftLastWriteTime.dwHighDateTime=0x1da3cb1, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELVberznZvjPQ3.doc", cAlternateFileName="ELVBER~1.DOC")) returned 1 [0332.807] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9900, ftCreationTime.dwHighDateTime=0x1d9eecb, ftLastAccessTime.dwLowDateTime=0xecfae120, ftLastAccessTime.dwHighDateTime=0x1d9f1cb, ftLastWriteTime.dwLowDateTime=0xecfae120, ftLastWriteTime.dwHighDateTime=0x1d9f1cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jv7Q8.docx", cAlternateFileName="JV7Q8~1.DOC")) returned 1 [0332.807] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0332.807] FindClose (in: hFindFile=0x587bba0 | out: hFindFile=0x587bba0) returned 1 [0332.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.808] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.rdp" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.rdp"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.809] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.809] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.809] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*key*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*key*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf965afc0, ftCreationTime.dwHighDateTime=0x1da2fe8, ftLastAccessTime.dwLowDateTime=0xa1c537d0, ftLastAccessTime.dwHighDateTime=0x1da4475, ftLastWriteTime.dwLowDateTime=0xa1c537d0, ftLastWriteTime.dwHighDateTime=0x1da4475, nFileSizeHigh=0x0, nFileSizeLow=0x50d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="V5tYkKqk3OZKey.xlsx", cAlternateFileName="V5TYKK~1.XLS")) returned 0x587bba0 [0332.809] FindNextFileW (in: hFindFile=0x587bba0, lpFindFileData=0x18e894 | out: lpFindFileData=0x18e894*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0332.810] FindClose (in: hFindFile=0x587bba0 | out: hFindFile=0x587bba0) returned 1 [0332.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.810] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*wallet*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*wallet*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.811] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.811] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.811] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*seed*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*seed*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.824] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*metamask*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*metamask*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0332.825] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.825] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.825] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*.lnk"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0332.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb1c) returned 1 [0332.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb28) returned 1 [0332.828] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.828] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", lpFilePart=0x0) returned 0x38 [0332.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.828] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8ea60w7-zi9o0_ xjic.docx"), fInfoLevelId=0x0, lpFileInformation=0x23ba594 | out: lpFileInformation=0x23ba594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde61ace0, ftCreationTime.dwHighDateTime=0x1d9bd8a, ftLastAccessTime.dwLowDateTime=0xa848ffe0, ftLastAccessTime.dwHighDateTime=0x1d9c16e, ftLastWriteTime.dwLowDateTime=0xa848ffe0, ftLastWriteTime.dwHighDateTime=0x1d9c16e, nFileSizeHigh=0x0, nFileSizeLow=0xb4ef)) returned 1 [0332.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.829] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.829] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", lpFilePart=0x0) returned 0x38 [0332.881] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.881] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", lpFilePart=0x0) returned 0x38 [0332.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.881] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8ea60w7-zi9o0_ xjic.docx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde61ace0, ftCreationTime.dwHighDateTime=0x1d9bd8a, ftLastAccessTime.dwLowDateTime=0xa848ffe0, ftLastAccessTime.dwHighDateTime=0x1d9c16e, ftLastWriteTime.dwLowDateTime=0xa848ffe0, ftLastWriteTime.dwHighDateTime=0x1d9c16e, nFileSizeHigh=0x0, nFileSizeLow=0xb4ef)) returned 1 [0332.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.882] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx", lpFilePart=0x0) returned 0x38 [0332.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.882] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\8Ea60w7-zI9o0_ xjIc.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\8ea60w7-zi9o0_ xjic.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.883] GetFileType (hFile=0x340) returned 0x1 [0332.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.883] GetFileType (hFile=0x340) returned 0x1 [0332.890] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.892] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.893] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.894] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.894] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.895] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.896] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.896] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.897] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.897] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.898] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.899] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x4ef, lpOverlapped=0x0) returned 1 [0332.899] ReadFile (in: hFile=0x340, lpBuffer=0x23bae97, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bae97*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.899] ReadFile (in: hFile=0x340, lpBuffer=0x23bba08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23bba08*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.904] CloseHandle (hObject=0x340) returned 1 [0332.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0332.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", lpFilePart=0x0) returned 0x31 [0332.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\aww7qifxgly7.docx"), fInfoLevelId=0x0, lpFileInformation=0x23e0120 | out: lpFileInformation=0x23e0120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ecbd80, ftCreationTime.dwHighDateTime=0x1d9c5cc, ftLastAccessTime.dwLowDateTime=0xd23b69e0, ftLastAccessTime.dwHighDateTime=0x1da4a27, ftLastWriteTime.dwLowDateTime=0xd23b69e0, ftLastWriteTime.dwHighDateTime=0x1da4a27, nFileSizeHigh=0x0, nFileSizeLow=0x6b80)) returned 1 [0332.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0332.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", lpFilePart=0x0) returned 0x31 [0332.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0332.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", lpFilePart=0x0) returned 0x31 [0332.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.907] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\aww7qifxgly7.docx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ecbd80, ftCreationTime.dwHighDateTime=0x1d9c5cc, ftLastAccessTime.dwLowDateTime=0xd23b69e0, ftLastAccessTime.dwHighDateTime=0x1da4a27, ftLastWriteTime.dwLowDateTime=0xd23b69e0, ftLastWriteTime.dwHighDateTime=0x1da4a27, nFileSizeHigh=0x0, nFileSizeLow=0x6b80)) returned 1 [0332.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0332.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx", lpFilePart=0x0) returned 0x31 [0332.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.908] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\AwW7QIFXglY7.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\aww7qifxgly7.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.908] GetFileType (hFile=0x340) returned 0x1 [0332.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.908] GetFileType (hFile=0x340) returned 0x1 [0332.908] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.910] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.911] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.912] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.913] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.913] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.914] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0xb80, lpOverlapped=0x0) returned 1 [0332.914] ReadFile (in: hFile=0x340, lpBuffer=0x23e0978, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e0978*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.914] ReadFile (in: hFile=0x340, lpBuffer=0x23e1258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x23e1258*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.916] CloseHandle (hObject=0x340) returned 1 [0332.916] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.916] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", lpFilePart=0x0) returned 0x38 [0332.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dleae5sswl_9u8jcrdw.docx"), fInfoLevelId=0x0, lpFileInformation=0x2406188 | out: lpFileInformation=0x2406188*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c4e4f0, ftCreationTime.dwHighDateTime=0x1d9dc35, ftLastAccessTime.dwLowDateTime=0xfb8c9340, ftLastAccessTime.dwHighDateTime=0x1da1d64, ftLastWriteTime.dwLowDateTime=0xfb8c9340, ftLastWriteTime.dwHighDateTime=0x1da1d64, nFileSizeHigh=0x0, nFileSizeLow=0x16f9)) returned 1 [0332.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", lpFilePart=0x0) returned 0x38 [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", lpFilePart=0x0) returned 0x38 [0332.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.917] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dleae5sswl_9u8jcrdw.docx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28c4e4f0, ftCreationTime.dwHighDateTime=0x1d9dc35, ftLastAccessTime.dwLowDateTime=0xfb8c9340, ftLastAccessTime.dwHighDateTime=0x1da1d64, ftLastWriteTime.dwLowDateTime=0xfb8c9340, ftLastWriteTime.dwHighDateTime=0x1da1d64, nFileSizeHigh=0x0, nFileSizeLow=0x16f9)) returned 1 [0332.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0332.918] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx", lpFilePart=0x0) returned 0x38 [0332.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.918] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DlEaE5sSwl_9U8JCrDw.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dleae5sswl_9u8jcrdw.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.918] GetFileType (hFile=0x340) returned 0x1 [0332.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.918] GetFileType (hFile=0x340) returned 0x1 [0332.919] ReadFile (in: hFile=0x340, lpBuffer=0x24072f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24072f0*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.921] ReadFile (in: hFile=0x340, lpBuffer=0x24072f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24072f0*, lpNumberOfBytesRead=0x18eb54*=0x6f9, lpOverlapped=0x0) returned 1 [0332.921] ReadFile (in: hFile=0x340, lpBuffer=0x2406989, nNumberOfBytesToRead=0x107, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2406989*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.921] ReadFile (in: hFile=0x340, lpBuffer=0x24072f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24072f0*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.922] CloseHandle (hObject=0x340) returned 1 [0332.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", lpFilePart=0x0) returned 0x32 [0332.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.922] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dlwgcfwwousi1.docx"), fInfoLevelId=0x0, lpFileInformation=0x2410894 | out: lpFileInformation=0x2410894*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe358df90, ftCreationTime.dwHighDateTime=0x1d9f0f0, ftLastAccessTime.dwLowDateTime=0x8c9c5d30, ftLastAccessTime.dwHighDateTime=0x1da42c1, ftLastWriteTime.dwLowDateTime=0x8c9c5d30, ftLastWriteTime.dwHighDateTime=0x1da42c1, nFileSizeHigh=0x0, nFileSizeLow=0x13c0f)) returned 1 [0332.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", lpFilePart=0x0) returned 0x32 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", lpFilePart=0x0) returned 0x32 [0332.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.923] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dlwgcfwwousi1.docx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe358df90, ftCreationTime.dwHighDateTime=0x1d9f0f0, ftLastAccessTime.dwLowDateTime=0x8c9c5d30, ftLastAccessTime.dwHighDateTime=0x1da42c1, ftLastWriteTime.dwLowDateTime=0x8c9c5d30, ftLastWriteTime.dwHighDateTime=0x1da42c1, nFileSizeHigh=0x0, nFileSizeLow=0x13c0f)) returned 1 [0332.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.923] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx", lpFilePart=0x0) returned 0x32 [0332.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.924] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dLWgCFWWoUsi1.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dlwgcfwwousi1.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.924] GetFileType (hFile=0x340) returned 0x1 [0332.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.924] GetFileType (hFile=0x340) returned 0x1 [0332.924] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.926] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.927] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.927] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.928] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.928] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.929] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.929] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.930] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.930] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.931] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.931] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.932] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.932] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.933] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.933] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.934] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.934] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.935] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.935] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0xc0f, lpOverlapped=0x0) returned 1 [0332.936] ReadFile (in: hFile=0x340, lpBuffer=0x2410d87, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2410d87*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.936] ReadFile (in: hFile=0x340, lpBuffer=0x24119d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x24119d8*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.944] CloseHandle (hObject=0x340) returned 1 [0332.944] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.944] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", lpFilePart=0x0) returned 0x32 [0332.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.944] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\elvberznzvjpq3.doc"), fInfoLevelId=0x0, lpFileInformation=0x2451920 | out: lpFileInformation=0x2451920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4faf32e0, ftCreationTime.dwHighDateTime=0x1da3bcc, ftLastAccessTime.dwLowDateTime=0x62d62410, ftLastAccessTime.dwHighDateTime=0x1da3cb1, ftLastWriteTime.dwLowDateTime=0x62d62410, ftLastWriteTime.dwHighDateTime=0x1da3cb1, nFileSizeHigh=0x0, nFileSizeLow=0x9580)) returned 1 [0332.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", lpFilePart=0x0) returned 0x32 [0332.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", lpFilePart=0x0) returned 0x32 [0332.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\elvberznzvjpq3.doc"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4faf32e0, ftCreationTime.dwHighDateTime=0x1da3bcc, ftLastAccessTime.dwLowDateTime=0x62d62410, ftLastAccessTime.dwHighDateTime=0x1da3cb1, ftLastWriteTime.dwLowDateTime=0x62d62410, ftLastWriteTime.dwHighDateTime=0x1da3cb1, nFileSizeHigh=0x0, nFileSizeLow=0x9580)) returned 1 [0332.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0332.946] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc", lpFilePart=0x0) returned 0x32 [0332.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.946] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ELVberznZvjPQ3.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\elvberznzvjpq3.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.947] GetFileType (hFile=0x340) returned 0x1 [0332.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.947] GetFileType (hFile=0x340) returned 0x1 [0332.948] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.951] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.951] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.965] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.967] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.970] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.974] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.975] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.977] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.978] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x580, lpOverlapped=0x0) returned 1 [0332.978] ReadFile (in: hFile=0x340, lpBuffer=0x2451f84, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2451f84*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.978] ReadFile (in: hFile=0x340, lpBuffer=0x2452a64, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2452a64*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.983] CloseHandle (hObject=0x340) returned 1 [0332.983] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0332.984] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x2b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", lpFilePart=0x0) returned 0x2a [0332.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.984] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jv7q8.docx"), fInfoLevelId=0x0, lpFileInformation=0x2483668 | out: lpFileInformation=0x2483668*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9900, ftCreationTime.dwHighDateTime=0x1d9eecb, ftLastAccessTime.dwLowDateTime=0xecfae120, ftLastAccessTime.dwHighDateTime=0x1d9f1cb, ftLastWriteTime.dwLowDateTime=0xecfae120, ftLastWriteTime.dwHighDateTime=0x1d9f1cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e0b)) returned 1 [0332.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x2b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", lpFilePart=0x0) returned 0x2a [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0332.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x2b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", lpFilePart=0x0) returned 0x2a [0332.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jv7q8.docx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f9900, ftCreationTime.dwHighDateTime=0x1d9eecb, ftLastAccessTime.dwLowDateTime=0xecfae120, ftLastAccessTime.dwHighDateTime=0x1d9f1cb, ftLastWriteTime.dwLowDateTime=0xecfae120, ftLastWriteTime.dwHighDateTime=0x1d9f1cb, nFileSizeHigh=0x0, nFileSizeLow=0x3e0b)) returned 1 [0332.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0332.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", nBufferLength=0x2b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx", lpFilePart=0x0) returned 0x2a [0332.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.986] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Jv7Q8.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\jv7q8.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.986] GetFileType (hFile=0x340) returned 0x1 [0332.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.987] GetFileType (hFile=0x340) returned 0x1 [0332.987] ReadFile (in: hFile=0x340, lpBuffer=0x248477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x248477c*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.989] ReadFile (in: hFile=0x340, lpBuffer=0x248477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x248477c*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.990] ReadFile (in: hFile=0x340, lpBuffer=0x248477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x248477c*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.990] ReadFile (in: hFile=0x340, lpBuffer=0x248477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x248477c*, lpNumberOfBytesRead=0x18eb54*=0xe0b, lpOverlapped=0x0) returned 1 [0332.990] ReadFile (in: hFile=0x340, lpBuffer=0x2483d27, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x2483d27*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.990] ReadFile (in: hFile=0x340, lpBuffer=0x248477c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x248477c*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0332.992] CloseHandle (hObject=0x340) returned 1 [0332.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0332.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", lpFilePart=0x0) returned 0x33 [0332.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eba8) returned 1 [0332.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\v5tykkqk3ozkey.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x2499110 | out: lpFileInformation=0x2499110*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf965afc0, ftCreationTime.dwHighDateTime=0x1da2fe8, ftLastAccessTime.dwLowDateTime=0xa1c537d0, ftLastAccessTime.dwHighDateTime=0x1da4475, ftLastWriteTime.dwLowDateTime=0xa1c537d0, ftLastWriteTime.dwHighDateTime=0x1da4475, nFileSizeHigh=0x0, nFileSizeLow=0x50d5)) returned 1 [0332.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eba4) returned 1 [0332.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x20 [0332.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x20, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", lpFilePart=0x0) returned 0x33 [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", lpFilePart=0x0) returned 0x33 [0332.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb18) returned 1 [0332.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\v5tykkqk3ozkey.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x18eb94 | out: lpFileInformation=0x18eb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf965afc0, ftCreationTime.dwHighDateTime=0x1da2fe8, ftLastAccessTime.dwLowDateTime=0xa1c537d0, ftLastAccessTime.dwHighDateTime=0x1da4475, ftLastWriteTime.dwLowDateTime=0xa1c537d0, ftLastWriteTime.dwHighDateTime=0x1da4475, nFileSizeHigh=0x0, nFileSizeLow=0x50d5)) returned 1 [0332.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0332.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx", lpFilePart=0x0) returned 0x33 [0332.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eaec) returned 1 [0332.995] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\V5tYkKqk3OZKey.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\v5tykkqk3ozkey.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x340 [0332.995] GetFileType (hFile=0x340) returned 0x1 [0332.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eae8) returned 1 [0332.995] GetFileType (hFile=0x340) returned 0x1 [0332.995] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.996] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.996] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.998] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.998] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x1000, lpOverlapped=0x0) returned 1 [0332.998] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0xd5, lpOverlapped=0x0) returned 1 [0332.999] ReadFile (in: hFile=0x340, lpBuffer=0x249a254, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x18eb54, lpOverlapped=0x0 | out: lpBuffer=0x249a254*, lpNumberOfBytesRead=0x18eb54*=0x0, lpOverlapped=0x0) returned 1 [0333.002] CloseHandle (hObject=0x340) returned 1 [0333.002] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0333.002] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\binance", lpDst=0x18eab8, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance") returned 0x2e [0333.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0333.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0333.002] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", nBufferLength=0x2e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", lpFilePart=0x0) returned 0x2d [0333.002] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance\\*.fp*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\*.fp*"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0333.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb24) returned 1 [0333.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb60) returned 1 [0333.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0333.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", nBufferLength=0x2e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance", lpFilePart=0x0) returned 0x2d [0333.008] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\binance\\*.lnk" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\binance\\*.lnk"), lpFindFileData=0x18e888 | out: lpFindFileData=0x18e888*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0333.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb24) returned 1 [0333.251] GetSystemMetrics (nIndex=78) returned 1440 [0333.251] GetSystemMetrics (nIndex=79) returned 900 [0333.277] GdiplusStartup (in: token=0x777fa8, input=0x18e140, output=0x18e190 | out: token=0x777fa8, output=0x18e190) returned 0x0 [0333.303] GdipCreateBitmapFromScan0 (width=1440, height=900, stride=0, format=0x26200a, scan0=0x0, bitmap=0x18ec48) returned 0x0 [0333.464] GdipGetImagePixelFormat (image=0x5f81f08, format=0x18ec4c) returned 0x0 [0333.464] GdipGetImageGraphicsContext (image=0x5f81f08, graphics=0x18ec58) returned 0x0 [0333.478] GdipSetInterpolationMode (graphics=0x5f82408, interpolationMode=0x4) returned 0x0 [0333.478] GdipSetPixelOffsetMode (graphics=0x5f82408, pixelOffsetMode=0x1) returned 0x0 [0333.479] GdipSetSmoothingMode (graphics=0x5f82408, smoothingMode=0x1) returned 0x0 [0333.483] GetDC (hWnd=0x0) returned 0xa0100d0 [0333.494] GetCurrentObject (hdc=0xa0100d0, type=0x1) returned 0x1b00017 [0333.494] GetCurrentObject (hdc=0xa0100d0, type=0x2) returned 0x1900010 [0333.494] GetCurrentObject (hdc=0xa0100d0, type=0x7) returned 0xbf050541 [0333.494] GetCurrentObject (hdc=0xa0100d0, type=0x6) returned 0x18a0048 [0333.496] GdipGetDC (graphics=0x5f82408, hdc=0x18ebd8) returned 0x0 [0333.614] BitBlt (hdc=0x59010983, x=0, y=0, cx=1440, cy=900, hdcSrc=0xa0100d0, x1=0, y1=0, rop=0xcc0020) returned 1 [0334.123] GdipReleaseDC (graphics=0x5f82408, hdc=0x59010983) returned 0x0 [0334.129] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0334.130] GdipDeleteGraphics (graphics=0x5f82408) returned 0x0 [0334.157] GdipGetImageEncodersSize (numEncoders=0x18ebd4, size=0x18ebd0) returned 0x0 [0334.157] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x5915910 [0334.158] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x5915910 | out: encoders=0x5915910) returned 0x0 [0334.165] LocalFree (hMem=0x5915910) returned 0x0 [0334.191] GdipSaveImageToStream (image=0x5f81f08, stream=0x760030, clsidEncoder=0x18ebe4*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0335.476] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.476] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Battle.net", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net") returned 0x2f [0335.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0335.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", lpFilePart=0x0) returned 0x2e [0335.542] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\battle.net\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.548] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.548] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromium\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data") returned 0x37 [0335.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.548] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.549] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0335.549] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.551] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.551] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x3c [0335.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.552] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0335.552] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0335.552] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.554] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.554] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data") returned 0x41 [0335.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.555] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0335.555] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x41, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpFilePart=0x0) returned 0x40 [0335.555] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google(x86)\\chrome\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.557] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.557] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned 0x36 [0335.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0335.558] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.560] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.560] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\Opera Stable\\", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\") returned 0x43 [0335.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.561] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0335.561] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\", lpFilePart=0x0) returned 0x42 [0335.561] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.563] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.563] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data") returned 0x45 [0335.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0335.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x45, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0335.565] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maplestudio\\chromeplus\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.567] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.567] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Iridium\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data") returned 0x36 [0335.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0335.567] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\iridium\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.570] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.570] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\7Star\\7Star\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data") returned 0x3a [0335.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0335.571] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0335.571] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.574] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.574] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CentBrowser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data") returned 0x3a [0335.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0335.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0335.575] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.577] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.577] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chedot\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data") returned 0x35 [0335.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0335.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0335.578] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.581] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.581] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Vivaldi\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data") returned 0x36 [0335.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0335.581] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.583] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.584] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Kometa\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data") returned 0x35 [0335.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.584] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0335.584] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0335.584] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.586] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.586] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Elements Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data") returned 0x3f [0335.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.587] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0335.587] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x3f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0335.587] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.590] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.590] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Epic Privacy Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data") returned 0x43 [0335.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.590] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0335.590] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0335.590] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.593] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.593] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data") returned 0x3d [0335.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.593] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0335.593] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0335.593] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.644] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.644] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer") returned 0x58 [0335.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.645] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x58 [0335.645] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x58, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0335.645] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.648] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.648] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data") returned 0x43 [0335.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0335.649] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0335.649] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\catalinagroup\\citrio\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.651] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.652] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Coowon\\Coowon\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data") returned 0x3c [0335.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.652] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0335.652] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0335.652] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coowon\\coowon\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.655] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.655] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\liebao\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data") returned 0x35 [0335.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.656] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0335.656] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0335.656] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\liebao\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.659] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.659] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\QIP Surf\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data") returned 0x37 [0335.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.659] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0335.660] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.662] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.662] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Orbitum\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data") returned 0x36 [0335.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.663] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0335.663] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.666] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.666] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\Dragon\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data") returned 0x3c [0335.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.666] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0335.666] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0335.666] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.669] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.669] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Amigo\\User\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data") returned 0x39 [0335.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0335.669] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", lpFilePart=0x0) returned 0x38 [0335.669] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.672] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.672] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Torch\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data") returned 0x34 [0335.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.672] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0335.672] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0335.672] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.678] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.679] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data") returned 0x43 [0335.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.679] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0335.679] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0335.679] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yandexbrowser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.682] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.682] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data") returned 0x35 [0335.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0335.683] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", lpFilePart=0x0) returned 0x34 [0335.683] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.686] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.686] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\360Browser\\Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data") returned 0x41 [0335.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.686] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0335.687] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x41, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", lpFilePart=0x0) returned 0x40 [0335.687] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.689] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.690] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Maxthon3\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data") returned 0x37 [0335.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.690] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.690] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", lpFilePart=0x0) returned 0x36 [0335.690] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon3\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.692] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.693] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\K-Melon\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data") returned 0x36 [0335.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", lpFilePart=0x0) returned 0x35 [0335.693] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\k-melon\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.695] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.695] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data") returned 0x3e [0335.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0335.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x3e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0335.696] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\sputnik\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.698] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.698] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Nichrome\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data") returned 0x37 [0335.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", lpFilePart=0x0) returned 0x36 [0335.699] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.701] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.701] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CocCoc\\Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data") returned 0x3d [0335.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0335.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0335.702] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.704] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.705] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Uran\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data") returned 0x33 [0335.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0335.705] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", lpFilePart=0x0) returned 0x32 [0335.705] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\uran\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.707] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.708] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromodo\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data") returned 0x37 [0335.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", lpFilePart=0x0) returned 0x36 [0335.708] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromodo\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.710] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.711] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data") returned 0x3b [0335.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0335.711] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpFilePart=0x0) returned 0x3a [0335.711] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\mail.ru\\atom\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.714] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.714] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data") returned 0x4a [0335.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0335.715] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x4a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0335.715] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\bravesoftware\\brave-browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.717] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.718] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Microsoft\\Edge\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data") returned 0x3d [0335.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0335.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0335.718] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.723] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.723] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience") returned 0x51 [0335.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0335.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x51, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpFilePart=0x0) returned 0x50 [0335.724] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nvidia corporation\\nvidia geforce experience\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.726] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.726] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Steam", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam") returned 0x2a [0335.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0335.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", lpFilePart=0x0) returned 0x29 [0335.727] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\steam\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.729] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.729] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CryptoTab Browser\\User Data", lpDst=0x18e998, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data") returned 0x40 [0335.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea34) returned 1 [0335.730] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0335.730] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x40, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", lpFilePart=0x0) returned 0x3f [0335.730] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\*"), lpFindFileData=0x18e75c | out: lpFindFileData=0x18e75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f8) returned 1 [0335.831] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.831] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Mozilla\\Firefox", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x36 [0335.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.831] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0335.831] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x35 [0335.832] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.835] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.835] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Waterfox", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox") returned 0x2f [0335.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0335.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", lpFilePart=0x0) returned 0x2e [0335.835] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.838] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.838] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\K-Meleon", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon") returned 0x2f [0335.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.838] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0335.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", lpFilePart=0x0) returned 0x2e [0335.839] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\k-meleon\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.841] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.841] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Thunderbird", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird") returned 0x32 [0335.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0335.842] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", lpFilePart=0x0) returned 0x31 [0335.842] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.845] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.845] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Comodo\\IceDragon", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon") returned 0x37 [0335.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0335.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", lpFilePart=0x0) returned 0x36 [0335.845] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\comodo\\icedragon\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.851] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.851] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox") returned 0x3c [0335.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.852] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0335.852] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpFilePart=0x0) returned 0x3b [0335.852] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.854] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.855] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw") returned 0x44 [0335.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0335.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpFilePart=0x0) returned 0x43 [0335.855] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhaw\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.858] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0335.858] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpDst=0x18eab4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon") returned 0x46 [0335.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb50) returned 1 [0335.858] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x46 [0335.858] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", nBufferLength=0x46, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpFilePart=0x0) returned 0x45 [0335.858] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\*"), lpFindFileData=0x18e878 | out: lpFindFileData=0x18e878*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0335.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb14) returned 1 [0335.871] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x630) returned 0x0 [0335.872] RegQueryInfoKeyW (in: hKey=0x630, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x18ec24, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ec20, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x18ec24*=0x42, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x18ec20*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.872] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x0, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.872] CoTaskMemFree (pv=0x0) [0335.872] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.872] CoTaskMemFree (pv=0x0) [0335.872] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.872] CoTaskMemFree (pv=0x0) [0335.872] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.872] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x4, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x5, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x6, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x7, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x8, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x9, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.873] CoTaskMemFree (pv=0x0) [0335.873] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xa, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.874] CoTaskMemFree (pv=0x0) [0335.874] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xb, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.874] CoTaskMemFree (pv=0x0) [0335.874] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xc, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.874] CoTaskMemFree (pv=0x0) [0335.874] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xd, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.874] CoTaskMemFree (pv=0x0) [0335.874] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xe, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.874] CoTaskMemFree (pv=0x0) [0335.874] RegEnumKeyExW (in: hKey=0x630, dwIndex=0xf, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x10, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x11, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x12, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x13, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x14, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.875] CoTaskMemFree (pv=0x0) [0335.875] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x15, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.876] CoTaskMemFree (pv=0x0) [0335.876] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x16, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.876] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x17, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.876] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x18, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x19, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1a, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1b, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1c, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1d, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0011-0000-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.877] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1e, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0015-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x1f, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0016-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x20, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0018-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x21, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0019-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x22, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001A-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x23, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001B-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x24, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.878] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x25, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-040C-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x26, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-001F-0C0A-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x27, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-002C-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x28, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0044-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x29, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-006E-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2a, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2b, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2c, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0090-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.879] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2d, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00A1-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2e, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00BA-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x2f, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E1-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x30, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-00E2-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x31, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0115-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x32, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-0117-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x33, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-012B-0409-0000-0000000FF1CE}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x34, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.880] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x35, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x36, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x37, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x38, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x39, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3a, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3b, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.881] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3c, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3d, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3e, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x3f, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x40, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegEnumKeyExW (in: hKey=0x630, dwIndex=0x41, lpName=0x2438388, lpcchName=0x18ec40, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x18ec40, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0335.882] RegOpenKeyExW (in: hKey=0x630, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.883] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.883] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.883] RegCloseKey (hKey=0x318) returned 0x0 [0335.883] RegOpenKeyExW (in: hKey=0x630, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.883] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.883] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.883] RegCloseKey (hKey=0x318) returned 0x0 [0335.883] RegOpenKeyExW (in: hKey=0x630, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.884] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.884] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.884] RegCloseKey (hKey=0x318) returned 0x0 [0335.884] RegOpenKeyExW (in: hKey=0x630, lpSubKey="DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.884] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.884] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.884] RegCloseKey (hKey=0x318) returned 0x0 [0335.884] RegOpenKeyExW (in: hKey=0x630, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.885] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.885] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.885] RegCloseKey (hKey=0x318) returned 0x0 [0335.885] RegOpenKeyExW (in: hKey=0x630, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.885] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.885] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.885] RegCloseKey (hKey=0x318) returned 0x0 [0335.885] RegOpenKeyExW (in: hKey=0x630, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.886] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.886] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.886] RegCloseKey (hKey=0x318) returned 0x0 [0335.886] RegOpenKeyExW (in: hKey=0x630, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.886] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.886] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.886] RegCloseKey (hKey=0x318) returned 0x0 [0335.886] RegOpenKeyExW (in: hKey=0x630, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.887] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.887] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.887] RegCloseKey (hKey=0x318) returned 0x0 [0335.887] RegOpenKeyExW (in: hKey=0x630, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.887] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.887] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.887] RegCloseKey (hKey=0x318) returned 0x0 [0335.887] RegOpenKeyExW (in: hKey=0x630, lpSubKey="MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.888] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.888] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.888] RegCloseKey (hKey=0x318) returned 0x0 [0335.888] RegOpenKeyExW (in: hKey=0x630, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.888] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.888] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.888] RegCloseKey (hKey=0x318) returned 0x0 [0335.888] RegOpenKeyExW (in: hKey=0x630, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.889] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.889] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.889] RegCloseKey (hKey=0x318) returned 0x0 [0335.889] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.889] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7e) returned 0x0 [0335.889] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243b094, lpcbData=0x18ec18*=0x7e | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x18ec18*=0x7e) returned 0x0 [0335.889] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x18) returned 0x0 [0335.890] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243b200, lpcbData=0x18ec18*=0x18 | out: lpType=0x18ec1c*=0x1, lpData="14.25.28508", lpcbData=0x18ec18*=0x18) returned 0x0 [0335.891] RegCloseKey (hKey=0x318) returned 0x0 [0335.891] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.891] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x76) returned 0x0 [0335.891] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243b720, lpcbData=0x18ec18*=0x76 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x18ec18*=0x76) returned 0x0 [0335.891] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.891] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243b87c, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="12.0.21005", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.892] RegCloseKey (hKey=0x318) returned 0x0 [0335.894] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.895] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.895] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.895] RegCloseKey (hKey=0x318) returned 0x0 [0335.895] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.895] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.895] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.895] RegCloseKey (hKey=0x318) returned 0x0 [0335.896] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.896] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.896] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.896] RegCloseKey (hKey=0x318) returned 0x0 [0335.896] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.896] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.896] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.896] RegCloseKey (hKey=0x318) returned 0x0 [0335.896] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegCloseKey (hKey=0x318) returned 0x0 [0335.897] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegCloseKey (hKey=0x318) returned 0x0 [0335.897] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.897] RegCloseKey (hKey=0x318) returned 0x0 [0335.897] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.898] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x78) returned 0x0 [0335.898] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243c8a0, lpcbData=0x18ec18*=0x78 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x18ec18*=0x78) returned 0x0 [0335.898] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x18) returned 0x0 [0335.898] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243c9fc, lpcbData=0x18ec18*=0x18 | out: lpType=0x18ec1c*=0x1, lpData="14.25.28508", lpcbData=0x18ec18*=0x18) returned 0x0 [0335.898] RegCloseKey (hKey=0x318) returned 0x0 [0335.898] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.899] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.899] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243cd74, lpcbData=0x18ec18*=0x7a | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.899] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.899] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243ced8, lpcbData=0x18ec18*=0x1a | out: lpType=0x18ec1c*=0x1, lpData="11.0.61030.0", lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.899] RegCloseKey (hKey=0x318) returned 0x0 [0335.899] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.900] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.900] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243d25c, lpcbData=0x18ec18*=0x7a | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.900] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.900] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243d3c0, lpcbData=0x18ec18*=0x1a | out: lpType=0x18ec1c*=0x1, lpData="12.0.30501.0", lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.900] RegCloseKey (hKey=0x318) returned 0x0 [0335.900] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.901] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x24) returned 0x0 [0335.901] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243d770, lpcbData=0x18ec18*=0x24 | out: lpType=0x18ec1c*=0x1, lpData="Java Auto Updater", lpcbData=0x18ec18*=0x24) returned 0x0 [0335.901] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.901] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243d824, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="2.8.171.11", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.901] RegCloseKey (hKey=0x318) returned 0x0 [0335.901] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.901] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x86) returned 0x0 [0335.902] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243db48, lpcbData=0x18ec18*=0x86 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x18ec18*=0x86) returned 0x0 [0335.902] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1c) returned 0x0 [0335.902] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243dcc4, lpcbData=0x18ec18*=0x1c | out: lpType=0x18ec1c*=0x1, lpData="14.25.28508.3", lpcbData=0x18ec18*=0x1c) returned 0x0 [0335.902] RegCloseKey (hKey=0x318) returned 0x0 [0335.902] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.903] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x86) returned 0x0 [0335.903] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243e058, lpcbData=0x18ec18*=0x86 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x18ec18*=0x86) returned 0x0 [0335.903] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1c) returned 0x0 [0335.903] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243e1d4, lpcbData=0x18ec18*=0x1c | out: lpType=0x18ec1c*=0x1, lpData="14.25.28508.3", lpcbData=0x18ec18*=0x1c) returned 0x0 [0335.903] RegCloseKey (hKey=0x318) returned 0x0 [0335.903] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.904] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x54) returned 0x0 [0335.904] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243e568, lpcbData=0x18ec18*=0x54 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x18ec18*=0x54) returned 0x0 [0335.904] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x14) returned 0x0 [0335.905] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x243e67c, lpcbData=0x18ec18*=0x14 | out: lpType=0x18ec1c*=0x1, lpData="8.0.61001", lpcbData=0x18ec18*=0x14) returned 0x0 [0335.905] RegCloseKey (hKey=0x318) returned 0x0 [0335.905] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0011-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.905] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.905] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.906] RegCloseKey (hKey=0x318) returned 0x0 [0335.906] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0015-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.906] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.906] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.906] RegCloseKey (hKey=0x318) returned 0x0 [0335.906] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0016-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.906] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.907] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.907] RegCloseKey (hKey=0x318) returned 0x0 [0335.907] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0018-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.907] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.907] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.907] RegCloseKey (hKey=0x318) returned 0x0 [0335.908] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0019-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.908] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.908] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.908] RegCloseKey (hKey=0x318) returned 0x0 [0335.909] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-001A-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.909] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.909] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.909] RegCloseKey (hKey=0x318) returned 0x0 [0335.909] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-001B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.909] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.909] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.909] RegCloseKey (hKey=0x318) returned 0x0 [0335.910] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-001F-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.910] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.910] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.910] RegCloseKey (hKey=0x318) returned 0x0 [0335.910] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-001F-040C-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.910] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.910] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.911] RegCloseKey (hKey=0x318) returned 0x0 [0335.911] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-001F-0C0A-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.911] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.911] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.911] RegCloseKey (hKey=0x318) returned 0x0 [0335.911] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-002C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.911] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.911] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.911] RegCloseKey (hKey=0x318) returned 0x0 [0335.912] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0044-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.912] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.912] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.912] RegCloseKey (hKey=0x318) returned 0x0 [0335.912] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-006E-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.912] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.912] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.912] RegCloseKey (hKey=0x318) returned 0x0 [0335.913] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.913] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.913] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.913] RegCloseKey (hKey=0x318) returned 0x0 [0335.913] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.913] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.913] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.913] RegCloseKey (hKey=0x318) returned 0x0 [0335.914] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0090-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.914] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.914] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.914] RegCloseKey (hKey=0x318) returned 0x0 [0335.914] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-00A1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.914] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.914] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.914] RegCloseKey (hKey=0x318) returned 0x0 [0335.915] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-00BA-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.915] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.915] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.915] RegCloseKey (hKey=0x318) returned 0x0 [0335.915] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-00E1-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.915] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.915] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.915] RegCloseKey (hKey=0x318) returned 0x0 [0335.915] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-00E2-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.916] RegCloseKey (hKey=0x318) returned 0x0 [0335.916] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0115-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.916] RegCloseKey (hKey=0x318) returned 0x0 [0335.916] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-0117-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.916] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.917] RegCloseKey (hKey=0x318) returned 0x0 [0335.917] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{90160000-012B-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.917] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.917] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.917] RegCloseKey (hKey=0x318) returned 0x0 [0335.917] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.917] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7e) returned 0x0 [0335.917] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x24411f4, lpcbData=0x18ec18*=0x7e | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x18ec18*=0x7e) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1e) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2441360, lpcbData=0x18ec18*=0x1e | out: lpType=0x18ec1c*=0x1, lpData="9.0.30729.6161", lpcbData=0x18ec18*=0x1e) returned 0x0 [0335.918] RegCloseKey (hKey=0x318) returned 0x0 [0335.918] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7c) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x24416f4, lpcbData=0x18ec18*=0x7c | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x18ec18*=0x7c) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.918] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2441858, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="11.0.61030", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.919] RegCloseKey (hKey=0x318) returned 0x0 [0335.919] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.919] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x76) returned 0x0 [0335.919] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2441bd4, lpcbData=0x18ec18*=0x76 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x18ec18*=0x76) returned 0x0 [0335.919] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.919] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2441d30, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="11.0.61030", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.919] RegCloseKey (hKey=0x318) returned 0x0 [0335.919] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x24420a4, lpcbData=0x18ec18*=0x7a | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2442208, lpcbData=0x18ec18*=0x1a | out: lpType=0x18ec1c*=0x1, lpData="11.0.61030.0", lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.920] RegCloseKey (hKey=0x318) returned 0x0 [0335.920] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x244258c, lpcbData=0x18ec18*=0x7a | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x18ec18*=0x7a) returned 0x0 [0335.920] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.921] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x24426f0, lpcbData=0x18ec18*=0x1a | out: lpType=0x18ec1c*=0x1, lpData="12.0.30501.0", lpcbData=0x18ec18*=0x1a) returned 0x0 [0335.921] RegCloseKey (hKey=0x318) returned 0x0 [0335.921] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.921] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x78) returned 0x0 [0335.921] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2442a74, lpcbData=0x18ec18*=0x78 | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x18ec18*=0x78) returned 0x0 [0335.921] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.921] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2442bd0, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="10.0.40219", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.922] RegCloseKey (hKey=0x318) returned 0x0 [0335.922] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.922] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.922] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.922] RegCloseKey (hKey=0x318) returned 0x0 [0335.922] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.923] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.923] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.923] RegCloseKey (hKey=0x318) returned 0x0 [0335.923] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.924] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.924] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.924] RegCloseKey (hKey=0x318) returned 0x0 [0335.924] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.924] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegCloseKey (hKey=0x318) returned 0x0 [0335.925] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.925] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegCloseKey (hKey=0x318) returned 0x0 [0335.925] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.925] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.925] RegCloseKey (hKey=0x318) returned 0x0 [0335.926] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x0, lpData=0x0, lpcbData=0x18ec18*=0x0) returned 0x2 [0335.926] RegCloseKey (hKey=0x318) returned 0x0 [0335.926] RegOpenKeyExW (in: hKey=0x630, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x18ebfc | out: phkResult=0x18ebfc*=0x318) returned 0x0 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x7c) returned 0x0 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayName", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2443bf8, lpcbData=0x18ec18*=0x7c | out: lpType=0x18ec1c*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x18ec18*=0x7c) returned 0x0 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x0, lpcbData=0x18ec18*=0x0 | out: lpType=0x18ec1c*=0x1, lpData=0x0, lpcbData=0x18ec18*=0x16) returned 0x0 [0335.926] RegQueryValueExW (in: hKey=0x318, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x18ec1c, lpData=0x2443d5c, lpcbData=0x18ec18*=0x16 | out: lpType=0x18ec1c*=0x1, lpData="12.0.21005", lpcbData=0x18ec18*=0x16) returned 0x0 [0335.927] RegCloseKey (hKey=0x318) returned 0x0 [0335.927] RegCloseKey (hKey=0x630) returned 0x0 [0336.085] CoTaskMemAlloc (cb=0x20c) returned 0x690b38 [0336.085] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x690b38 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0336.086] CoTaskMemFree (pv=0x690b38) [0336.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0336.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x26, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0336.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0336.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0336.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb9c) returned 1 [0336.087] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0336.087] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0336.087] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb\\*.log" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb\\*.log"), lpFindFileData=0x18e8c4 | out: lpFindFileData=0x18e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0336.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb60) returned 1 [0336.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0336.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0336.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eb9c) returned 1 [0336.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0336.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", nBufferLength=0x44, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0336.090] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Discord\\Local Storage\\leveldb\\*.ldb" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb\\*.ldb"), lpFindFileData=0x18e8c4 | out: lpFindFileData=0x18e8c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0336.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18eb60) returned 1 [0336.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebf0 | out: puCount=0x18ebf0*=0x2) returned 0x0 [0336.162] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebec*=0x0, pszText=0x0 | out: puBuffLength=0x18ebec*=0xf, pszText=0x0) returned 0x0 [0336.162] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebec*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0336.162] CoGetObjectContext (in: riid=0x2249d44*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb78 | out: ppv=0x18eb78*=0x692bc4) returned 0x0 [0336.163] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb70 | out: pAptType=0x18eb70*=1) returned 0x0 [0336.163] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249d2c*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb74 | out: ppvObject=0x18eb74*=0x0) returned 0x80004002 [0336.163] IUnknown:Release (This=0x692bc4) returned 0x0 [0336.164] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e788 | out: ppv=0x18e788*=0x58cb1b0) returned 0x0 [0336.164] WbemLocator:IUnknown:QueryInterface (in: This=0x58cb1b0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x0) returned 0x80004002 [0336.165] WbemLocator:IClassFactory:CreateInstance (in: This=0x58cb1b0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b0 | out: ppvObject=0x18e9b0*=0x58b34e0) returned 0x0 [0336.165] WbemLocator:IUnknown:Release (This=0x58cb1b0) returned 0x0 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5d4 | out: ppvObject=0x18e5d4*=0x58b34e0) returned 0x0 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x0) returned 0x80004002 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e184 | out: ppvObject=0x18e184*=0x0) returned 0x80004002 [0336.165] WbemLocator:IUnknown:AddRef (This=0x58b34e0) returned 0x3 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dee4 | out: ppvObject=0x18dee4*=0x0) returned 0x80004002 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de94 | out: ppvObject=0x18de94*=0x0) returned 0x80004002 [0336.165] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dea0 | out: ppvObject=0x18dea0*=0x0) returned 0x80004002 [0336.165] CoGetContextToken (in: pToken=0x18df00 | out: pToken=0x18df00) returned 0x0 [0336.165] CoGetObjectContext (in: riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x58cb064 | out: ppv=0x58cb064*=0x692bb8) returned 0x0 [0336.166] CoGetContextToken (in: pToken=0x18e308 | out: pToken=0x18e308) returned 0x0 [0336.166] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e394 | out: ppvObject=0x18e394*=0x0) returned 0x80004002 [0336.166] WbemLocator:IUnknown:Release (This=0x58b34e0) returned 0x2 [0336.166] WbemLocator:IUnknown:Release (This=0x58b34e0) returned 0x1 [0336.166] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0336.166] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0336.166] WbemLocator:IUnknown:QueryInterface (in: This=0x58b34e0, riid=0x18e9c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x58b34e0) returned 0x0 [0336.166] WbemLocator:IUnknown:AddRef (This=0x58b34e0) returned 0x3 [0336.166] WbemLocator:IUnknown:Release (This=0x58b34e0) returned 0x2 [0336.166] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18eb54 | out: puCount=0x18eb54*=0x2) returned 0x0 [0336.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb50*=0x0, pszText=0x0 | out: puBuffLength=0x18eb50*=0xf, pszText=0x0) returned 0x0 [0336.166] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=8, puBuffLength=0x18eb50*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb50*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0336.167] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea2c | out: ppv=0x18ea2c*=0x58b32f0) returned 0x0 [0336.167] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58b32f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eac0 | out: ppNamespace=0x18eac0*=0x58bcf68) returned 0x0 [0336.229] WbemLocator:IUnknown:QueryInterface (in: This=0x58bcf68, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e954 | out: ppvObject=0x18e954*=0x6c26e4) returned 0x0 [0336.229] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c26e4, pProxy=0x58bcf68, pAuthnSvc=0x18e9a4, pAuthzSvc=0x18e9a0, pServerPrincName=0x18e998, pAuthnLevel=0x18e99c, pImpLevel=0x18e98c, pAuthInfo=0x18e990, pCapabilites=0x18e994 | out: pAuthnSvc=0x18e9a4*=0xa, pAuthzSvc=0x18e9a0*=0x0, pServerPrincName=0x18e998, pAuthnLevel=0x18e99c*=0x6, pImpLevel=0x18e98c*=0x2, pAuthInfo=0x18e990, pCapabilites=0x18e994*=0x1) returned 0x0 [0336.230] WbemLocator:IUnknown:Release (This=0x6c26e4) returned 0x1 [0336.230] WbemLocator:IUnknown:QueryInterface (in: This=0x58bcf68, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e948 | out: ppvObject=0x18e948*=0x6c2708) returned 0x0 [0336.230] WbemLocator:IUnknown:QueryInterface (in: This=0x58bcf68, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e934 | out: ppvObject=0x18e934*=0x6c26e4) returned 0x0 [0336.230] WbemLocator:IClientSecurity:SetBlanket (This=0x6c26e4, pProxy=0x58bcf68, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0336.230] WbemLocator:IUnknown:Release (This=0x6c26e4) returned 0x2 [0336.230] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x1 [0336.230] CoTaskMemFree (pv=0x6db7e8) [0336.231] WbemLocator:IUnknown:Release (This=0x58b32f0) returned 0x0 [0336.231] WbemLocator:IUnknown:QueryInterface (in: This=0x58bcf68, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e544 | out: ppvObject=0x18e544*=0x6c2708) returned 0x0 [0336.231] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e500 | out: ppvObject=0x18e500*=0x0) returned 0x80004002 [0336.232] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e31c | out: ppvObject=0x18e31c*=0x0) returned 0x80004002 [0336.233] WbemLocator:IUnknown:QueryInterface (in: This=0x58bcf68, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0f4 | out: ppvObject=0x18e0f4*=0x0) returned 0x80004002 [0336.234] WbemLocator:IUnknown:AddRef (This=0x6c2708) returned 0x3 [0336.234] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de54 | out: ppvObject=0x18de54*=0x0) returned 0x80004002 [0336.234] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de04 | out: ppvObject=0x18de04*=0x0) returned 0x80004002 [0336.234] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de10 | out: ppvObject=0x18de10*=0x6c2664) returned 0x0 [0336.234] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2664, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de18 | out: pCid=0x18de18*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0336.234] WbemLocator:IUnknown:Release (This=0x6c2664) returned 0x3 [0336.234] CoGetContextToken (in: pToken=0x18de70 | out: pToken=0x18de70) returned 0x0 [0336.235] CoGetContextToken (in: pToken=0x18e278 | out: pToken=0x18e278) returned 0x0 [0336.235] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e304 | out: ppvObject=0x18e304*=0x6c26ec) returned 0x0 [0336.235] WbemLocator:IRpcOptions:Query (in: This=0x6c26ec, pPrx=0x6c2708, dwProperty=2, pdwValue=0x18e310 | out: pdwValue=0x18e310) returned 0x80004002 [0336.235] WbemLocator:IUnknown:Release (This=0x6c26ec) returned 0x3 [0336.235] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x2 [0336.235] CoGetContextToken (in: pToken=0x18e858 | out: pToken=0x18e858) returned 0x0 [0336.235] CoGetContextToken (in: pToken=0x18e7b8 | out: pToken=0x18e7b8) returned 0x0 [0336.235] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x18e888*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e884 | out: ppvObject=0x18e884*=0x58bcf68) returned 0x0 [0336.235] WbemLocator:IUnknown:AddRef (This=0x58bcf68) returned 0x4 [0336.235] WbemLocator:IUnknown:Release (This=0x58bcf68) returned 0x3 [0336.235] WbemLocator:IUnknown:Release (This=0x58bcf68) returned 0x2 [0336.235] SysStringLen (param_1=0x0) returned 0x0 [0336.236] CoGetContextToken (in: pToken=0x18e858 | out: pToken=0x18e858) returned 0x0 [0336.236] WbemLocator:IUnknown:AddRef (This=0x6c2708) returned 0x3 [0336.236] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2708, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6ec | out: ppvObject=0x18e6ec*=0x6c2708) returned 0x0 [0336.236] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x3 [0336.236] WbemLocator:IUnknown:Release (This=0x6c2708) returned 0x2 [0336.236] CoGetContextToken (in: pToken=0x18e950 | out: pToken=0x18e950) returned 0x0 [0336.236] WbemLocator:IUnknown:AddRef (This=0x58bcf68) returned 0x3 [0336.236] IWbemServices:ExecQuery (in: This=0x58bcf68, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x18eb60 | out: ppEnum=0x18eb60*=0x73c838) returned 0x0 [0336.242] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x73c83c) returned 0x0 [0336.242] IClientSecurity:QueryBlanket (in: This=0x73c83c, pProxy=0x73c838, pAuthnSvc=0x18ea0c, pAuthzSvc=0x18ea08, pServerPrincName=0x18ea00, pAuthnLevel=0x18ea04, pImpLevel=0x18e9f4, pAuthInfo=0x18e9f8, pCapabilites=0x18e9fc | out: pAuthnSvc=0x18ea0c*=0xa, pAuthzSvc=0x18ea08*=0x0, pServerPrincName=0x18ea00, pAuthnLevel=0x18ea04*=0x6, pImpLevel=0x18e9f4*=0x2, pAuthInfo=0x18e9f8, pCapabilites=0x18e9fc*=0x1) returned 0x0 [0336.242] IUnknown:Release (This=0x73c83c) returned 0x1 [0336.242] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b0 | out: ppvObject=0x18e9b0*=0x6c2d08) returned 0x0 [0336.242] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e99c | out: ppvObject=0x18e99c*=0x73c83c) returned 0x0 [0336.242] IClientSecurity:SetBlanket (This=0x73c83c, pProxy=0x73c838, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0336.261] IUnknown:Release (This=0x73c83c) returned 0x2 [0336.261] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x1 [0336.261] CoTaskMemFree (pv=0x6dbb48) [0336.261] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5a8 | out: ppvObject=0x18e5a8*=0x6c2d08) returned 0x0 [0336.261] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e564 | out: ppvObject=0x18e564*=0x0) returned 0x80004002 [0336.293] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e384 | out: ppvObject=0x18e384*=0x0) returned 0x80004002 [0336.293] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e15c | out: ppvObject=0x18e15c*=0x0) returned 0x80004002 [0336.294] WbemLocator:IUnknown:AddRef (This=0x6c2d08) returned 0x3 [0336.294] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18debc | out: ppvObject=0x18debc*=0x0) returned 0x80004002 [0336.294] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de6c | out: ppvObject=0x18de6c*=0x0) returned 0x80004002 [0336.294] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de78 | out: ppvObject=0x18de78*=0x6c2c64) returned 0x0 [0336.295] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2c64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de80 | out: pCid=0x18de80*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0336.295] WbemLocator:IUnknown:Release (This=0x6c2c64) returned 0x3 [0336.295] CoGetContextToken (in: pToken=0x18ded8 | out: pToken=0x18ded8) returned 0x0 [0336.295] CoGetContextToken (in: pToken=0x18e2e0 | out: pToken=0x18e2e0) returned 0x0 [0336.295] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x6c2cec) returned 0x0 [0336.295] WbemLocator:IRpcOptions:Query (in: This=0x6c2cec, pPrx=0x6c2d08, dwProperty=2, pdwValue=0x18e378 | out: pdwValue=0x18e378) returned 0x80004002 [0336.295] WbemLocator:IUnknown:Release (This=0x6c2cec) returned 0x3 [0336.295] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x2 [0336.296] CoGetContextToken (in: pToken=0x18e8b8 | out: pToken=0x18e8b8) returned 0x0 [0336.296] CoGetContextToken (in: pToken=0x18e818 | out: pToken=0x18e818) returned 0x0 [0336.296] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2d08, riid=0x18e8e8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8e4 | out: ppvObject=0x18e8e4*=0x73c838) returned 0x0 [0336.296] IUnknown:AddRef (This=0x73c838) returned 0x4 [0336.296] IUnknown:Release (This=0x73c838) returned 0x3 [0336.296] IUnknown:Release (This=0x73c838) returned 0x2 [0336.296] WbemLocator:IUnknown:Release (This=0x58bcf68) returned 0x2 [0336.296] SysStringLen (param_1=0x0) returned 0x0 [0336.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebac | out: puCount=0x18ebac*=0x2) returned 0x0 [0336.296] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eba8*=0x0, pszText=0x0 | out: puBuffLength=0x18eba8*=0xf, pszText=0x0) returned 0x0 [0336.296] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18eba8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eba8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0336.296] CoGetContextToken (in: pToken=0x18e9f8 | out: pToken=0x18e9f8) returned 0x0 [0336.296] IUnknown:AddRef (This=0x73c838) returned 0x3 [0336.296] IEnumWbemClassObject:Clone (in: This=0x73c838, ppEnum=0x18ebb8 | out: ppEnum=0x18ebb8*=0x73c068) returned 0x0 [0336.298] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea74 | out: ppvObject=0x18ea74*=0x73c06c) returned 0x0 [0336.299] IClientSecurity:QueryBlanket (in: This=0x73c06c, pProxy=0x73c068, pAuthnSvc=0x18eac4, pAuthzSvc=0x18eac0, pServerPrincName=0x18eab8, pAuthnLevel=0x18eabc, pImpLevel=0x18eaac, pAuthInfo=0x18eab0, pCapabilites=0x18eab4 | out: pAuthnSvc=0x18eac4*=0xa, pAuthzSvc=0x18eac0*=0x0, pServerPrincName=0x18eab8, pAuthnLevel=0x18eabc*=0x6, pImpLevel=0x18eaac*=0x2, pAuthInfo=0x18eab0, pCapabilites=0x18eab4*=0x1) returned 0x0 [0336.299] IUnknown:Release (This=0x73c06c) returned 0x1 [0336.299] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea68 | out: ppvObject=0x18ea68*=0x6c1508) returned 0x0 [0336.299] IUnknown:QueryInterface (in: This=0x73c068, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea54 | out: ppvObject=0x18ea54*=0x73c06c) returned 0x0 [0336.299] IClientSecurity:SetBlanket (This=0x73c06c, pProxy=0x73c068, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0336.302] IUnknown:Release (This=0x73c06c) returned 0x2 [0336.302] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x1 [0336.302] CoTaskMemFree (pv=0x6db848) [0336.302] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e650 | out: ppvObject=0x18e650*=0x6c1508) returned 0x0 [0336.302] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e60c | out: ppvObject=0x18e60c*=0x0) returned 0x80004002 [0336.303] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e42c | out: ppvObject=0x18e42c*=0x0) returned 0x80004002 [0336.304] IUnknown:QueryInterface (in: This=0x73c068, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0336.305] WbemLocator:IUnknown:AddRef (This=0x6c1508) returned 0x3 [0336.305] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df64 | out: ppvObject=0x18df64*=0x0) returned 0x80004002 [0336.305] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df14 | out: ppvObject=0x18df14*=0x0) returned 0x80004002 [0336.305] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df20 | out: ppvObject=0x18df20*=0x6c1464) returned 0x0 [0336.305] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1464, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df28 | out: pCid=0x18df28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0336.305] WbemLocator:IUnknown:Release (This=0x6c1464) returned 0x3 [0336.305] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0336.306] CoGetContextToken (in: pToken=0x18e388 | out: pToken=0x18e388) returned 0x0 [0336.306] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x6c14ec) returned 0x0 [0336.306] WbemLocator:IRpcOptions:Query (in: This=0x6c14ec, pPrx=0x6c1508, dwProperty=2, pdwValue=0x18e420 | out: pdwValue=0x18e420) returned 0x80004002 [0336.306] WbemLocator:IUnknown:Release (This=0x6c14ec) returned 0x3 [0336.306] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x2 [0336.306] CoGetContextToken (in: pToken=0x18e960 | out: pToken=0x18e960) returned 0x0 [0336.306] CoGetContextToken (in: pToken=0x18e8c0 | out: pToken=0x18e8c0) returned 0x0 [0336.306] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1508, riid=0x18e990*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e98c | out: ppvObject=0x18e98c*=0x73c068) returned 0x0 [0336.306] IUnknown:AddRef (This=0x73c068) returned 0x4 [0336.306] IUnknown:Release (This=0x73c068) returned 0x3 [0336.306] IUnknown:Release (This=0x73c068) returned 0x2 [0336.306] IUnknown:Release (This=0x73c838) returned 0x2 [0336.306] SysStringLen (param_1=0x0) returned 0x0 [0336.307] IEnumWbemClassObject:Reset (This=0x73c068) returned 0x0 [0336.308] CoTaskMemAlloc (cb=0x4) returned 0x58b35e0 [0336.308] IEnumWbemClassObject:Next (in: This=0x73c068, lTimeout=-1, uCount=0x1, apObjects=0x58b35e0, puReturned=0x24468ac | out: apObjects=0x58b35e0*=0x6ca7a0, puReturned=0x24468ac*=0x1) returned 0x0 [0340.795] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e210 | out: ppvObject=0x18e210*=0x6ca7a0) returned 0x0 [0340.795] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1cc | out: ppvObject=0x18e1cc*=0x0) returned 0x80004002 [0340.795] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dfec | out: ppvObject=0x18dfec*=0x0) returned 0x80004002 [0340.795] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddc4 | out: ppvObject=0x18ddc4*=0x0) returned 0x80004002 [0340.796] IUnknown:AddRef (This=0x6ca7a0) returned 0x3 [0340.796] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db24 | out: ppvObject=0x18db24*=0x0) returned 0x80004002 [0340.796] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dad4 | out: ppvObject=0x18dad4*=0x0) returned 0x80004002 [0340.796] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae0 | out: ppvObject=0x18dae0*=0x6ca7a4) returned 0x0 [0340.796] IMarshal:GetUnmarshalClass (in: This=0x6ca7a4, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dae8 | out: pCid=0x18dae8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0340.796] IUnknown:Release (This=0x6ca7a4) returned 0x3 [0340.796] CoGetContextToken (in: pToken=0x18db40 | out: pToken=0x18db40) returned 0x0 [0340.797] CoGetContextToken (in: pToken=0x18df48 | out: pToken=0x18df48) returned 0x0 [0340.797] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfd4 | out: ppvObject=0x18dfd4*=0x0) returned 0x80004002 [0340.797] IUnknown:Release (This=0x6ca7a0) returned 0x2 [0340.797] CoGetContextToken (in: pToken=0x18e520 | out: pToken=0x18e520) returned 0x0 [0340.797] CoGetContextToken (in: pToken=0x18e480 | out: pToken=0x18e480) returned 0x0 [0340.797] IUnknown:QueryInterface (in: This=0x6ca7a0, riid=0x18e550*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e54c | out: ppvObject=0x18e54c*=0x6ca7a0) returned 0x0 [0340.797] IUnknown:AddRef (This=0x6ca7a0) returned 0x4 [0340.797] IUnknown:Release (This=0x6ca7a0) returned 0x3 [0340.797] IUnknown:Release (This=0x6ca7a0) returned 0x2 [0340.797] CoTaskMemFree (pv=0x58b35e0) [0340.797] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0340.797] IUnknown:AddRef (This=0x6ca7a0) returned 0x3 [0340.798] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="__GENUS", lFlags=0, pVal=0x18eba8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec28*=0, plFlavor=0x18ec24*=0 | out: pVal=0x18eba8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec28*=3, plFlavor=0x18ec24*=64) returned 0x0 [0340.798] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="__PATH", lFlags=0, pVal=0x18eb8c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec10*=0, plFlavor=0x18ec0c*=0 | out: pVal=0x18eb8c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x18ec10*=8, plFlavor=0x18ec0c*=64) returned 0x0 [0340.799] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0340.799] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0340.799] CoGetObjectContext (in: riid=0x2249d44*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebb8 | out: ppv=0x18ebb8*=0x692bc4) returned 0x0 [0340.800] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb0 | out: pAptType=0x18ebb0*=1) returned 0x0 [0340.800] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249d2c*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb4 | out: ppvObject=0x18ebb4*=0x0) returned 0x80004002 [0340.800] IUnknown:Release (This=0x692bc4) returned 0x1 [0340.804] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x58b3570) returned 0x0 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x58b3570, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0340.805] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58b3570, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5906380) returned 0x0 [0340.805] WbemDefPath:IUnknown:Release (This=0x58b3570) returned 0x0 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5906380) returned 0x0 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0340.805] WbemDefPath:IUnknown:AddRef (This=0x5906380) returned 0x3 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0340.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb180) returned 0x0 [0340.806] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb180, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0340.806] WbemDefPath:IUnknown:Release (This=0x58cb180) returned 0x3 [0340.806] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0340.806] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0340.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0340.806] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x2 [0340.806] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x1 [0340.806] CoGetContextToken (in: pToken=0x18ea30 | out: pToken=0x18ea30) returned 0x0 [0340.806] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0340.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x5906380, riid=0x18ea60*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea5c | out: ppvObject=0x18ea5c*=0x5906380) returned 0x0 [0340.806] WbemDefPath:IUnknown:AddRef (This=0x5906380) returned 0x3 [0340.806] WbemDefPath:IUnknown:Release (This=0x5906380) returned 0x2 [0340.806] WbemDefPath:IWbemPath:SetText (This=0x5906380, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0340.806] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebe4 | out: puCount=0x18ebe4*=0x2) returned 0x0 [0340.807] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe0*=0xf, pszText=0x0) returned 0x0 [0340.807] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebe0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0340.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb0 | out: puCount=0x18ebb0*=0x2) returned 0x0 [0340.807] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0x0, pszText=0x0 | out: puBuffLength=0x18ebac*=0xf, pszText=0x0) returned 0x0 [0340.807] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0340.807] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="Name", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24474a4*=0, plFlavor=0x24474a8*=0 | out: pVal=0x18ebac*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x24474a4*=8, plFlavor=0x24474a8*=0) returned 0x0 [0340.807] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0340.807] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0340.807] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="Name", lFlags=0, pVal=0x18ebb4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24474a4*=8, plFlavor=0x24474a8*=0 | out: pVal=0x18ebb4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x24474a4*=8, plFlavor=0x24474a8*=0) returned 0x0 [0340.807] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0340.807] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0340.808] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6b4bf0, puCount=0x18ebb0 | out: puCount=0x18ebb0*=0x2) returned 0x0 [0340.808] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0x0, pszText=0x0 | out: puBuffLength=0x18ebac*=0xf, pszText=0x0) returned 0x0 [0340.808] WbemDefPath:IWbemPath:GetText (in: This=0x6b4bf0, lFlags=4, puBuffLength=0x18ebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0340.808] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="NumberOfCores", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2447600*=0, plFlavor=0x2447604*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2447600*=19, plFlavor=0x2447604*=0) returned 0x0 [0340.808] IWbemClassObject:Get (in: This=0x6ca7a0, wszName="NumberOfCores", lFlags=0, pVal=0x18ebb4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2447600*=19, plFlavor=0x2447604*=0 | out: pVal=0x18ebb4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2447600*=19, plFlavor=0x2447604*=0) returned 0x0 [0340.809] CoTaskMemAlloc (cb=0x4) returned 0x58b35d0 [0340.809] IEnumWbemClassObject:Next (in: This=0x73c068, lTimeout=-1, uCount=0x1, apObjects=0x58b35d0, puReturned=0x24468ac | out: apObjects=0x58b35d0*=0x0, puReturned=0x24468ac*=0x0) returned 0x1 [0340.823] CoTaskMemFree (pv=0x58b35d0) [0340.824] CoGetContextToken (in: pToken=0x18ead8 | out: pToken=0x18ead8) returned 0x0 [0340.824] WbemLocator:IUnknown:Release (This=0x6c1508) returned 0x1 [0340.824] IUnknown:Release (This=0x73c068) returned 0x0 [0340.827] CoGetContextToken (in: pToken=0x18ead8 | out: pToken=0x18ead8) returned 0x0 [0340.827] WbemLocator:IUnknown:Release (This=0x6c2d08) returned 0x1 [0340.827] IUnknown:Release (This=0x73c838) returned 0x0 [0340.870] CoGetObjectContext (in: riid=0x2249d44*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebd8 | out: ppv=0x18ebd8*=0x692bc4) returned 0x0 [0340.870] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebd0 | out: pAptType=0x18ebd0*=1) returned 0x0 [0340.871] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249d2c*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebd4 | out: ppvObject=0x18ebd4*=0x0) returned 0x80004002 [0340.871] IUnknown:Release (This=0x692bc4) returned 0x1 [0340.872] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e540 | out: ppv=0x18e540*=0x58b36c0) returned 0x0 [0340.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x58b36c0, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e75c | out: ppvObject=0x18e75c*=0x0) returned 0x80004002 [0340.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58b36c0, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e768 | out: ppvObject=0x18e768*=0x5905c10) returned 0x0 [0340.872] WbemDefPath:IUnknown:Release (This=0x58b36c0) returned 0x0 [0340.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e38c | out: ppvObject=0x18e38c*=0x5905c10) returned 0x0 [0340.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e348 | out: ppvObject=0x18e348*=0x0) returned 0x80004002 [0340.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df3c | out: ppvObject=0x18df3c*=0x0) returned 0x80004002 [0340.873] WbemDefPath:IUnknown:AddRef (This=0x5905c10) returned 0x3 [0340.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc9c | out: ppvObject=0x18dc9c*=0x0) returned 0x80004002 [0340.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc4c | out: ppvObject=0x18dc4c*=0x0) returned 0x80004002 [0340.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc58 | out: ppvObject=0x18dc58*=0x58cb168) returned 0x0 [0340.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb168, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc60 | out: pCid=0x18dc60*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0340.873] WbemDefPath:IUnknown:Release (This=0x58cb168) returned 0x3 [0340.873] CoGetContextToken (in: pToken=0x18dcb8 | out: pToken=0x18dcb8) returned 0x0 [0340.873] CoGetContextToken (in: pToken=0x18e0c0 | out: pToken=0x18e0c0) returned 0x0 [0340.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e14c | out: ppvObject=0x18e14c*=0x0) returned 0x80004002 [0340.873] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x2 [0340.873] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x1 [0340.873] CoGetContextToken (in: pToken=0x18ea50 | out: pToken=0x18ea50) returned 0x0 [0340.874] CoGetContextToken (in: pToken=0x18e9b0 | out: pToken=0x18e9b0) returned 0x0 [0340.874] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905c10, riid=0x18ea80*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea7c | out: ppvObject=0x18ea7c*=0x5905c10) returned 0x0 [0340.874] WbemDefPath:IUnknown:AddRef (This=0x5905c10) returned 0x3 [0340.874] WbemDefPath:IUnknown:Release (This=0x5905c10) returned 0x2 [0340.874] WbemDefPath:IWbemPath:SetText (This=0x5905c10, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18ec00 | out: puCount=0x18ec00*=0x2) returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebfc*=0x0, pszText=0x0 | out: puBuffLength=0x18ebfc*=0xf, pszText=0x0) returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebfc*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebfc*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18ebec | out: puCount=0x18ebec*=0x2) returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebe8*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe8*=0xf, pszText=0x0) returned 0x0 [0340.874] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebe8*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe8*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0340.874] CoGetObjectContext (in: riid=0x2249d44*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18eb7c | out: ppv=0x18eb7c*=0x692bc4) returned 0x0 [0340.874] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18eb74 | out: pAptType=0x18eb74*=1) returned 0x0 [0340.874] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249d2c*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18eb78 | out: ppvObject=0x18eb78*=0x0) returned 0x80004002 [0340.874] IUnknown:Release (This=0x692bc4) returned 0x1 [0340.875] CoGetClassObject (in: rclsid=0x69bd1c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e788 | out: ppv=0x18e788*=0x58cb360) returned 0x0 [0340.875] WbemLocator:IUnknown:QueryInterface (in: This=0x58cb360, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e9a4 | out: ppvObject=0x18e9a4*=0x0) returned 0x80004002 [0340.875] WbemLocator:IClassFactory:CreateInstance (in: This=0x58cb360, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b0 | out: ppvObject=0x18e9b0*=0x58b3500) returned 0x0 [0340.876] WbemLocator:IUnknown:Release (This=0x58cb360) returned 0x0 [0340.876] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5d4 | out: ppvObject=0x18e5d4*=0x58b3500) returned 0x0 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e590 | out: ppvObject=0x18e590*=0x0) returned 0x80004002 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e184 | out: ppvObject=0x18e184*=0x0) returned 0x80004002 [0340.877] WbemLocator:IUnknown:AddRef (This=0x58b3500) returned 0x3 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dee4 | out: ppvObject=0x18dee4*=0x0) returned 0x80004002 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de94 | out: ppvObject=0x18de94*=0x0) returned 0x80004002 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dea0 | out: ppvObject=0x18dea0*=0x0) returned 0x80004002 [0340.877] CoGetContextToken (in: pToken=0x18df00 | out: pToken=0x18df00) returned 0x0 [0340.877] CoGetContextToken (in: pToken=0x18e308 | out: pToken=0x18e308) returned 0x0 [0340.877] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e394 | out: ppvObject=0x18e394*=0x0) returned 0x80004002 [0340.877] WbemLocator:IUnknown:Release (This=0x58b3500) returned 0x2 [0340.878] WbemLocator:IUnknown:Release (This=0x58b3500) returned 0x1 [0340.878] CoGetContextToken (in: pToken=0x18e990 | out: pToken=0x18e990) returned 0x0 [0340.878] CoGetContextToken (in: pToken=0x18e8f0 | out: pToken=0x18e8f0) returned 0x0 [0340.878] WbemLocator:IUnknown:QueryInterface (in: This=0x58b3500, riid=0x18e9c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e9bc | out: ppvObject=0x18e9bc*=0x58b3500) returned 0x0 [0340.878] WbemLocator:IUnknown:AddRef (This=0x58b3500) returned 0x3 [0340.878] WbemLocator:IUnknown:Release (This=0x58b3500) returned 0x2 [0340.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18eb58 | out: puCount=0x18eb58*=0x2) returned 0x0 [0340.878] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=8, puBuffLength=0x18eb54*=0x0, pszText=0x0 | out: puBuffLength=0x18eb54*=0xf, pszText=0x0) returned 0x0 [0340.878] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=8, puBuffLength=0x18eb54*=0xf, pszText="00000000000000" | out: puBuffLength=0x18eb54*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0340.878] CoCreateInstance (in: rclsid=0x703713b4*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x70371414*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x18ea30 | out: ppv=0x18ea30*=0x58b3620) returned 0x0 [0340.878] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58b3620, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x18eac4 | out: ppNamespace=0x18eac4*=0x58bd238) returned 0x0 [0341.004] WbemLocator:IUnknown:QueryInterface (in: This=0x58bd238, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e958 | out: ppvObject=0x18e958*=0x6c1ae4) returned 0x0 [0341.005] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x6c1ae4, pProxy=0x58bd238, pAuthnSvc=0x18e9a8, pAuthzSvc=0x18e9a4, pServerPrincName=0x18e99c, pAuthnLevel=0x18e9a0, pImpLevel=0x18e990, pAuthInfo=0x18e994, pCapabilites=0x18e998 | out: pAuthnSvc=0x18e9a8*=0xa, pAuthzSvc=0x18e9a4*=0x0, pServerPrincName=0x18e99c, pAuthnLevel=0x18e9a0*=0x6, pImpLevel=0x18e990*=0x2, pAuthInfo=0x18e994, pCapabilites=0x18e998*=0x1) returned 0x0 [0341.005] WbemLocator:IUnknown:Release (This=0x6c1ae4) returned 0x1 [0341.005] WbemLocator:IUnknown:QueryInterface (in: This=0x58bd238, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e94c | out: ppvObject=0x18e94c*=0x6c1b08) returned 0x0 [0341.005] WbemLocator:IUnknown:QueryInterface (in: This=0x58bd238, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e938 | out: ppvObject=0x18e938*=0x6c1ae4) returned 0x0 [0341.005] WbemLocator:IClientSecurity:SetBlanket (This=0x6c1ae4, pProxy=0x58bd238, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0341.006] WbemLocator:IUnknown:Release (This=0x6c1ae4) returned 0x2 [0341.006] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x1 [0341.006] CoTaskMemFree (pv=0x6e4a48) [0341.006] WbemLocator:IUnknown:Release (This=0x58b3620) returned 0x0 [0341.006] WbemLocator:IUnknown:QueryInterface (in: This=0x58bd238, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e548 | out: ppvObject=0x18e548*=0x6c1b08) returned 0x0 [0341.006] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e504 | out: ppvObject=0x18e504*=0x0) returned 0x80004002 [0341.007] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e324 | out: ppvObject=0x18e324*=0x0) returned 0x80004002 [0341.008] WbemLocator:IUnknown:QueryInterface (in: This=0x58bd238, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e0fc | out: ppvObject=0x18e0fc*=0x0) returned 0x80004002 [0341.008] WbemLocator:IUnknown:AddRef (This=0x6c1b08) returned 0x3 [0341.009] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18de5c | out: ppvObject=0x18de5c*=0x0) returned 0x80004002 [0341.009] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de0c | out: ppvObject=0x18de0c*=0x0) returned 0x80004002 [0341.009] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de18 | out: ppvObject=0x18de18*=0x6c1a64) returned 0x0 [0341.009] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1a64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de20 | out: pCid=0x18de20*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0341.009] WbemLocator:IUnknown:Release (This=0x6c1a64) returned 0x3 [0341.009] CoGetContextToken (in: pToken=0x18de78 | out: pToken=0x18de78) returned 0x0 [0341.009] CoGetContextToken (in: pToken=0x18e280 | out: pToken=0x18e280) returned 0x0 [0341.009] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e30c | out: ppvObject=0x18e30c*=0x6c1aec) returned 0x0 [0341.009] WbemLocator:IRpcOptions:Query (in: This=0x6c1aec, pPrx=0x6c1b08, dwProperty=2, pdwValue=0x18e318 | out: pdwValue=0x18e318) returned 0x80004002 [0341.009] WbemLocator:IUnknown:Release (This=0x6c1aec) returned 0x3 [0341.009] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x2 [0341.009] CoGetContextToken (in: pToken=0x18e858 | out: pToken=0x18e858) returned 0x0 [0341.009] CoGetContextToken (in: pToken=0x18e7b8 | out: pToken=0x18e7b8) returned 0x0 [0341.009] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x18e888*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x18e884 | out: ppvObject=0x18e884*=0x58bd238) returned 0x0 [0341.010] WbemLocator:IUnknown:AddRef (This=0x58bd238) returned 0x4 [0341.010] WbemLocator:IUnknown:Release (This=0x58bd238) returned 0x3 [0341.010] WbemLocator:IUnknown:Release (This=0x58bd238) returned 0x2 [0341.010] SysStringLen (param_1=0x0) returned 0x0 [0341.010] CoGetContextToken (in: pToken=0x18e860 | out: pToken=0x18e860) returned 0x0 [0341.010] WbemLocator:IUnknown:AddRef (This=0x6c1b08) returned 0x3 [0341.010] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1b08, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e6f4 | out: ppvObject=0x18e6f4*=0x6c1b08) returned 0x0 [0341.010] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x3 [0341.010] WbemLocator:IUnknown:Release (This=0x6c1b08) returned 0x2 [0341.010] CoGetContextToken (in: pToken=0x18e948 | out: pToken=0x18e948) returned 0x0 [0341.010] WbemLocator:IUnknown:AddRef (This=0x58bd238) returned 0x3 [0341.010] IWbemServices:ExecQuery (in: This=0x58bd238, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x18eb64 | out: ppEnum=0x18eb64*=0x73bd48) returned 0x0 [0341.050] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9b4 | out: ppvObject=0x18e9b4*=0x73bd4c) returned 0x0 [0341.050] IClientSecurity:QueryBlanket (in: This=0x73bd4c, pProxy=0x73bd48, pAuthnSvc=0x18ea04, pAuthzSvc=0x18ea00, pServerPrincName=0x18e9f8, pAuthnLevel=0x18e9fc, pImpLevel=0x18e9ec, pAuthInfo=0x18e9f0, pCapabilites=0x18e9f4 | out: pAuthnSvc=0x18ea04*=0xa, pAuthzSvc=0x18ea00*=0x0, pServerPrincName=0x18e9f8, pAuthnLevel=0x18e9fc*=0x6, pImpLevel=0x18e9ec*=0x2, pAuthInfo=0x18e9f0, pCapabilites=0x18e9f4*=0x1) returned 0x0 [0341.050] IUnknown:Release (This=0x73bd4c) returned 0x1 [0341.050] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e9a8 | out: ppvObject=0x18e9a8*=0x6c2f08) returned 0x0 [0341.050] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0x73bd4c) returned 0x0 [0341.050] IClientSecurity:SetBlanket (This=0x73bd4c, pProxy=0x73bd48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0341.052] IUnknown:Release (This=0x73bd4c) returned 0x2 [0341.052] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x1 [0341.052] CoTaskMemFree (pv=0x6e50d8) [0341.053] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e5a0 | out: ppvObject=0x18e5a0*=0x6c2f08) returned 0x0 [0341.053] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e55c | out: ppvObject=0x18e55c*=0x0) returned 0x80004002 [0341.053] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e37c | out: ppvObject=0x18e37c*=0x0) returned 0x80004002 [0341.054] IUnknown:QueryInterface (in: This=0x73bd48, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e154 | out: ppvObject=0x18e154*=0x0) returned 0x80004002 [0341.054] WbemLocator:IUnknown:AddRef (This=0x6c2f08) returned 0x3 [0341.054] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18deb4 | out: ppvObject=0x18deb4*=0x0) returned 0x80004002 [0341.054] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18de64 | out: ppvObject=0x18de64*=0x0) returned 0x80004002 [0341.054] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18de70 | out: ppvObject=0x18de70*=0x6c2e64) returned 0x0 [0341.055] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c2e64, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18de78 | out: pCid=0x18de78*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0341.055] WbemLocator:IUnknown:Release (This=0x6c2e64) returned 0x3 [0341.055] CoGetContextToken (in: pToken=0x18ded0 | out: pToken=0x18ded0) returned 0x0 [0341.055] CoGetContextToken (in: pToken=0x18e2d8 | out: pToken=0x18e2d8) returned 0x0 [0341.055] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e364 | out: ppvObject=0x18e364*=0x6c2eec) returned 0x0 [0341.055] WbemLocator:IRpcOptions:Query (in: This=0x6c2eec, pPrx=0x6c2f08, dwProperty=2, pdwValue=0x18e370 | out: pdwValue=0x18e370) returned 0x80004002 [0341.055] WbemLocator:IUnknown:Release (This=0x6c2eec) returned 0x3 [0341.055] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x2 [0341.055] CoGetContextToken (in: pToken=0x18e8b0 | out: pToken=0x18e8b0) returned 0x0 [0341.055] CoGetContextToken (in: pToken=0x18e810 | out: pToken=0x18e810) returned 0x0 [0341.055] WbemLocator:IUnknown:QueryInterface (in: This=0x6c2f08, riid=0x18e8e0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e8dc | out: ppvObject=0x18e8dc*=0x73bd48) returned 0x0 [0341.055] IUnknown:AddRef (This=0x73bd48) returned 0x4 [0341.055] IUnknown:Release (This=0x73bd48) returned 0x3 [0341.055] IUnknown:Release (This=0x73bd48) returned 0x2 [0341.055] WbemLocator:IUnknown:Release (This=0x58bd238) returned 0x2 [0341.055] SysStringLen (param_1=0x0) returned 0x0 [0341.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18ebb0 | out: puCount=0x18ebb0*=0x2) returned 0x0 [0341.056] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebac*=0x0, pszText=0x0 | out: puBuffLength=0x18ebac*=0xf, pszText=0x0) returned 0x0 [0341.056] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebac*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebac*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0341.056] CoGetContextToken (in: pToken=0x18ea00 | out: pToken=0x18ea00) returned 0x0 [0341.056] IUnknown:AddRef (This=0x73bd48) returned 0x3 [0341.056] IEnumWbemClassObject:Clone (in: This=0x73bd48, ppEnum=0x18ebbc | out: ppEnum=0x18ebbc*=0x73c838) returned 0x0 [0341.057] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea78 | out: ppvObject=0x18ea78*=0x73c83c) returned 0x0 [0341.057] IClientSecurity:QueryBlanket (in: This=0x73c83c, pProxy=0x73c838, pAuthnSvc=0x18eac8, pAuthzSvc=0x18eac4, pServerPrincName=0x18eabc, pAuthnLevel=0x18eac0, pImpLevel=0x18eab0, pAuthInfo=0x18eab4, pCapabilites=0x18eab8 | out: pAuthnSvc=0x18eac8*=0xa, pAuthzSvc=0x18eac4*=0x0, pServerPrincName=0x18eabc, pAuthnLevel=0x18eac0*=0x6, pImpLevel=0x18eab0*=0x2, pAuthInfo=0x18eab4, pCapabilites=0x18eab8*=0x1) returned 0x0 [0341.057] IUnknown:Release (This=0x73c83c) returned 0x1 [0341.058] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371224*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea6c | out: ppvObject=0x18ea6c*=0x6c1708) returned 0x0 [0341.058] IUnknown:QueryInterface (in: This=0x73c838, riid=0x70371234*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18ea58 | out: ppvObject=0x18ea58*=0x73c83c) returned 0x0 [0341.058] IClientSecurity:SetBlanket (This=0x73c83c, pProxy=0x73c838, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0341.128] IUnknown:Release (This=0x73c83c) returned 0x2 [0341.128] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x1 [0341.128] CoTaskMemFree (pv=0x6e4ef8) [0341.129] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e654 | out: ppvObject=0x18e654*=0x6c1708) returned 0x0 [0341.129] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e610 | out: ppvObject=0x18e610*=0x0) returned 0x80004002 [0341.129] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e42c | out: ppvObject=0x18e42c*=0x0) returned 0x80004002 [0341.130] IUnknown:QueryInterface (in: This=0x73c838, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18e204 | out: ppvObject=0x18e204*=0x0) returned 0x80004002 [0341.130] WbemLocator:IUnknown:AddRef (This=0x6c1708) returned 0x3 [0341.130] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18df64 | out: ppvObject=0x18df64*=0x0) returned 0x80004002 [0341.130] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18df14 | out: ppvObject=0x18df14*=0x0) returned 0x80004002 [0341.130] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18df20 | out: ppvObject=0x18df20*=0x6c1664) returned 0x0 [0341.130] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6c1664, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18df28 | out: pCid=0x18df28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0341.130] WbemLocator:IUnknown:Release (This=0x6c1664) returned 0x3 [0341.131] CoGetContextToken (in: pToken=0x18df80 | out: pToken=0x18df80) returned 0x0 [0341.131] CoGetContextToken (in: pToken=0x18e388 | out: pToken=0x18e388) returned 0x0 [0341.131] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e414 | out: ppvObject=0x18e414*=0x6c16ec) returned 0x0 [0341.131] WbemLocator:IRpcOptions:Query (in: This=0x6c16ec, pPrx=0x6c1708, dwProperty=2, pdwValue=0x18e420 | out: pdwValue=0x18e420) returned 0x80004002 [0341.131] WbemLocator:IUnknown:Release (This=0x6c16ec) returned 0x3 [0341.131] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x2 [0341.131] CoGetContextToken (in: pToken=0x18e968 | out: pToken=0x18e968) returned 0x0 [0341.131] CoGetContextToken (in: pToken=0x18e8c8 | out: pToken=0x18e8c8) returned 0x0 [0341.131] WbemLocator:IUnknown:QueryInterface (in: This=0x6c1708, riid=0x18e998*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x18e994 | out: ppvObject=0x18e994*=0x73c838) returned 0x0 [0341.131] IUnknown:AddRef (This=0x73c838) returned 0x4 [0341.131] IUnknown:Release (This=0x73c838) returned 0x3 [0341.131] IUnknown:Release (This=0x73c838) returned 0x2 [0341.131] IUnknown:Release (This=0x73bd48) returned 0x2 [0341.131] SysStringLen (param_1=0x0) returned 0x0 [0341.131] IEnumWbemClassObject:Reset (This=0x73c838) returned 0x0 [0341.132] CoTaskMemAlloc (cb=0x4) returned 0x58b35e0 [0341.132] IEnumWbemClassObject:Next (in: This=0x73c838, lTimeout=-1, uCount=0x1, apObjects=0x58b35e0, puReturned=0x24487ac | out: apObjects=0x58b35e0*=0x6cbc58, puReturned=0x24487ac*=0x1) returned 0x0 [0341.138] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e218 | out: ppvObject=0x18e218*=0x6cbc58) returned 0x0 [0341.138] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e1d4 | out: ppvObject=0x18e1d4*=0x0) returned 0x80004002 [0341.138] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9bb4*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18dff4 | out: ppvObject=0x18dff4*=0x0) returned 0x80004002 [0341.138] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18ddcc | out: ppvObject=0x18ddcc*=0x0) returned 0x80004002 [0341.138] IUnknown:AddRef (This=0x6cbc58) returned 0x3 [0341.139] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18db2c | out: ppvObject=0x18db2c*=0x0) returned 0x80004002 [0341.139] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dadc | out: ppvObject=0x18dadc*=0x0) returned 0x80004002 [0341.139] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dae8 | out: ppvObject=0x18dae8*=0x6cbc5c) returned 0x0 [0341.139] IMarshal:GetUnmarshalClass (in: This=0x6cbc5c, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18daf0 | out: pCid=0x18daf0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0341.139] IUnknown:Release (This=0x6cbc5c) returned 0x3 [0341.139] CoGetContextToken (in: pToken=0x18db48 | out: pToken=0x18db48) returned 0x0 [0341.139] CoGetContextToken (in: pToken=0x18df50 | out: pToken=0x18df50) returned 0x0 [0341.139] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dfdc | out: ppvObject=0x18dfdc*=0x0) returned 0x80004002 [0341.139] IUnknown:Release (This=0x6cbc58) returned 0x2 [0341.139] CoGetContextToken (in: pToken=0x18e528 | out: pToken=0x18e528) returned 0x0 [0341.139] CoGetContextToken (in: pToken=0x18e488 | out: pToken=0x18e488) returned 0x0 [0341.139] IUnknown:QueryInterface (in: This=0x6cbc58, riid=0x18e558*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x18e554 | out: ppvObject=0x18e554*=0x6cbc58) returned 0x0 [0341.139] IUnknown:AddRef (This=0x6cbc58) returned 0x4 [0341.139] IUnknown:Release (This=0x6cbc58) returned 0x3 [0341.139] IUnknown:Release (This=0x6cbc58) returned 0x2 [0341.139] CoTaskMemFree (pv=0x58b35e0) [0341.139] CoGetContextToken (in: pToken=0x18e898 | out: pToken=0x18e898) returned 0x0 [0341.139] IUnknown:AddRef (This=0x6cbc58) returned 0x3 [0341.139] IWbemClassObject:Get (in: This=0x6cbc58, wszName="__GENUS", lFlags=0, pVal=0x18ebac*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec2c*=0, plFlavor=0x18ec28*=0 | out: pVal=0x18ebac*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x18ec2c*=3, plFlavor=0x18ec28*=64) returned 0x0 [0341.140] IWbemClassObject:Get (in: This=0x6cbc58, wszName="__PATH", lFlags=0, pVal=0x18eb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x18ec14*=0, plFlavor=0x18ec10*=0 | out: pVal=0x18eb90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x18ec14*=8, plFlavor=0x18ec10*=64) returned 0x0 [0341.140] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0341.140] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0341.140] CoGetObjectContext (in: riid=0x2249d44*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18ebbc | out: ppv=0x18ebbc*=0x692bc4) returned 0x0 [0341.140] IComThreadingInfo:GetCurrentApartmentType (in: This=0x692bc4, pAptType=0x18ebb4 | out: pAptType=0x18ebb4*=1) returned 0x0 [0341.140] IUnknown:QueryInterface (in: This=0x692bc4, riid=0x2249d2c*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x18ebb8 | out: ppvObject=0x18ebb8*=0x0) returned 0x80004002 [0341.140] IUnknown:Release (This=0x692bc4) returned 0x1 [0341.141] CoGetClassObject (in: rclsid=0x69bc5c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6f4d4d80*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x18e520 | out: ppv=0x18e520*=0x58b3570) returned 0x0 [0341.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x58b3570, riid=0x6f4b79fc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x18e73c | out: ppvObject=0x18e73c*=0x0) returned 0x80004002 [0341.141] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58b3570, pUnkOuter=0x0, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e748 | out: ppvObject=0x18e748*=0x5905820) returned 0x0 [0341.141] WbemDefPath:IUnknown:Release (This=0x58b3570) returned 0x0 [0341.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e36c | out: ppvObject=0x18e36c*=0x5905820) returned 0x0 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9c98*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x18e328 | out: ppvObject=0x18e328*=0x0) returned 0x80004002 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9c88*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x18df1c | out: ppvObject=0x18df1c*=0x0) returned 0x80004002 [0341.142] WbemDefPath:IUnknown:AddRef (This=0x5905820) returned 0x3 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f98cc*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x18dc7c | out: ppvObject=0x18dc7c*=0x0) returned 0x80004002 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9820*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x18dc2c | out: ppvObject=0x18dc2c*=0x0) returned 0x80004002 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f39a540*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18dc38 | out: ppvObject=0x18dc38*=0x58cb468) returned 0x0 [0341.142] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58cb468, riid=0x6f38de2c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x18dc40 | out: pCid=0x18dc40*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0341.142] WbemDefPath:IUnknown:Release (This=0x58cb468) returned 0x3 [0341.142] CoGetContextToken (in: pToken=0x18dc98 | out: pToken=0x18dc98) returned 0x0 [0341.142] CoGetContextToken (in: pToken=0x18e0a0 | out: pToken=0x18e0a0) returned 0x0 [0341.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x6f4f9b0c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x18e12c | out: ppvObject=0x18e12c*=0x0) returned 0x80004002 [0341.142] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x2 [0341.142] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x1 [0341.142] CoGetContextToken (in: pToken=0x18ea38 | out: pToken=0x18ea38) returned 0x0 [0341.142] CoGetContextToken (in: pToken=0x18e998 | out: pToken=0x18e998) returned 0x0 [0341.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x5905820, riid=0x18ea68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x18ea64 | out: ppvObject=0x18ea64*=0x5905820) returned 0x0 [0341.143] WbemDefPath:IUnknown:AddRef (This=0x5905820) returned 0x3 [0341.143] WbemDefPath:IUnknown:Release (This=0x5905820) returned 0x2 [0341.143] WbemDefPath:IWbemPath:SetText (This=0x5905820, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18ebe8 | out: puCount=0x18ebe8*=0x2) returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebe4*=0x0, pszText=0x0 | out: puBuffLength=0x18ebe4*=0xf, pszText=0x0) returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebe4*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebe4*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5905c10, puCount=0x18ebb4 | out: puCount=0x18ebb4*=0x2) returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebb0*=0x0, pszText=0x0 | out: puBuffLength=0x18ebb0*=0xf, pszText=0x0) returned 0x0 [0341.143] WbemDefPath:IWbemPath:GetText (in: This=0x5905c10, lFlags=4, puBuffLength=0x18ebb0*=0xf, pszText="00000000000000" | out: puBuffLength=0x18ebb0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0341.143] IWbemClassObject:Get (in: This=0x6cbc58, wszName="AdapterRAM", lFlags=0, pVal=0x18ebb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2448fdc*=0, plFlavor=0x2448fe0*=0 | out: pVal=0x18ebb0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2448fdc*=19, plFlavor=0x2448fe0*=0) returned 0x0 [0341.143] IWbemClassObject:Get (in: This=0x6cbc58, wszName="AdapterRAM", lFlags=0, pVal=0x18ebb8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2448fdc*=19, plFlavor=0x2448fe0*=0 | out: pVal=0x18ebb8*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2448fdc*=19, plFlavor=0x2448fe0*=0) returned 0x0 [0341.144] CoTaskMemAlloc (cb=0x4) returned 0x58b35e0 [0341.144] IEnumWbemClassObject:Next (in: This=0x73c838, lTimeout=-1, uCount=0x1, apObjects=0x58b35e0, puReturned=0x24487ac | out: apObjects=0x58b35e0*=0x0, puReturned=0x24487ac*=0x0) returned 0x1 [0341.145] CoTaskMemFree (pv=0x58b35e0) [0341.145] CoGetContextToken (in: pToken=0x18eae0 | out: pToken=0x18eae0) returned 0x0 [0341.145] WbemLocator:IUnknown:Release (This=0x6c1708) returned 0x1 [0341.145] IUnknown:Release (This=0x73c838) returned 0x0 [0341.147] CoGetContextToken (in: pToken=0x18eae0 | out: pToken=0x18eae0) returned 0x0 [0341.147] WbemLocator:IUnknown:Release (This=0x6c2f08) returned 0x1 [0341.147] IUnknown:Release (This=0x73bd48) returned 0x0 [0341.327] CoTaskMemAlloc (cb=0x20c) returned 0x690b38 [0341.327] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x690b38 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0341.328] CoTaskMemFree (pv=0x690b38) [0341.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0341.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x26, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0341.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eac0) returned 1 [0341.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x26 [0341.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x26, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0341.332] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\*"), lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e10d913, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x5e10d913, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.334] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e10d913, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x5e10d913, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.334] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dcff790, ftCreationTime.dwHighDateTime=0x1da4226, ftLastAccessTime.dwLowDateTime=0x663f5fd0, ftLastAccessTime.dwHighDateTime=0x1da486f, ftLastWriteTime.dwLowDateTime=0x663f5fd0, ftLastWriteTime.dwHighDateTime=0x1da486f, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Mdo3V0fBwhj.jpg", cAlternateFileName="-MDO3V~1.JPG")) returned 1 [0341.334] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9829550, ftCreationTime.dwHighDateTime=0x1da3b7b, ftLastAccessTime.dwLowDateTime=0x1c52d3f0, ftLastAccessTime.dwHighDateTime=0x1da3bc4, ftLastWriteTime.dwLowDateTime=0x1c52d3f0, ftLastWriteTime.dwHighDateTime=0x1da3bc4, nFileSizeHigh=0x0, nFileSizeLow=0x1145b, dwReserved0=0x0, dwReserved1=0x0, cFileName="0g-2zMwFszfiVk7OAfO.mkv", cAlternateFileName="0G-2ZM~1.MKV")) returned 1 [0341.335] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8ab7550, ftCreationTime.dwHighDateTime=0x1da4104, ftLastAccessTime.dwLowDateTime=0x92bbc160, ftLastAccessTime.dwHighDateTime=0x1da42d0, ftLastWriteTime.dwLowDateTime=0x92bbc160, ftLastWriteTime.dwHighDateTime=0x1da42d0, nFileSizeHigh=0x0, nFileSizeLow=0x11fb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="0S0_lcFfm9iYgQtjlOU.gif", cAlternateFileName="0S0_LC~1.GIF")) returned 1 [0341.335] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5651520, ftCreationTime.dwHighDateTime=0x1da4774, ftLastAccessTime.dwLowDateTime=0x533963f0, ftLastAccessTime.dwHighDateTime=0x1da49d6, ftLastWriteTime.dwLowDateTime=0x533963f0, ftLastWriteTime.dwHighDateTime=0x1da49d6, nFileSizeHigh=0x0, nFileSizeLow=0x174e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ax9jFRjb.png", cAlternateFileName="2AX9JF~1.PNG")) returned 1 [0341.336] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5eeb650, ftCreationTime.dwHighDateTime=0x1da4955, ftLastAccessTime.dwLowDateTime=0x49f10ea0, ftLastAccessTime.dwHighDateTime=0x1da4abd, ftLastWriteTime.dwLowDateTime=0x49f10ea0, ftLastWriteTime.dwHighDateTime=0x1da4abd, nFileSizeHigh=0x0, nFileSizeLow=0xc8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Zqd4RJS7Bd.wav", cAlternateFileName="3ZQD4R~1.WAV")) returned 1 [0341.336] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc00d80, ftCreationTime.dwHighDateTime=0x1da3cb6, ftLastAccessTime.dwLowDateTime=0x6164d70, ftLastAccessTime.dwHighDateTime=0x1da44e7, ftLastWriteTime.dwLowDateTime=0x6164d70, ftLastWriteTime.dwHighDateTime=0x1da44e7, nFileSizeHigh=0x0, nFileSizeLow=0x5f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="4RDooOZt5lueuLvNc.swf", cAlternateFileName="4RDOOO~1.SWF")) returned 1 [0341.336] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471053d0, ftCreationTime.dwHighDateTime=0x1da4220, ftLastAccessTime.dwLowDateTime=0x6aabb660, ftLastAccessTime.dwHighDateTime=0x1da4458, ftLastWriteTime.dwLowDateTime=0x6aabb660, ftLastWriteTime.dwHighDateTime=0x1da4458, nFileSizeHigh=0x0, nFileSizeLow=0xd554, dwReserved0=0x0, dwReserved1=0x0, cFileName="5vDtRNlkuI.xlsx", cAlternateFileName="5VDTRN~1.XLS")) returned 1 [0341.337] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad688f60, ftCreationTime.dwHighDateTime=0x1da4a79, ftLastAccessTime.dwLowDateTime=0x9d06b00, ftLastAccessTime.dwHighDateTime=0x1da4a94, ftLastWriteTime.dwLowDateTime=0x9d06b00, ftLastWriteTime.dwHighDateTime=0x1da4a94, nFileSizeHigh=0x0, nFileSizeLow=0x1175f, dwReserved0=0x0, dwReserved1=0x0, cFileName="9ulYs.mp3", cAlternateFileName="")) returned 1 [0341.337] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0341.337] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee52a1d0, ftCreationTime.dwHighDateTime=0x1da3cde, ftLastAccessTime.dwLowDateTime=0xcda98ed0, ftLastAccessTime.dwHighDateTime=0x1da4aad, ftLastWriteTime.dwLowDateTime=0xcda98ed0, ftLastWriteTime.dwHighDateTime=0x1da4aad, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C9KHsuJfCXTQDp_zq-.wav", cAlternateFileName="C9KHSU~1.WAV")) returned 1 [0341.338] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899fe780, ftCreationTime.dwHighDateTime=0x1da44ad, ftLastAccessTime.dwLowDateTime=0x2d7131c0, ftLastAccessTime.dwHighDateTime=0x1da49cc, ftLastWriteTime.dwLowDateTime=0x2d7131c0, ftLastWriteTime.dwHighDateTime=0x1da49cc, nFileSizeHigh=0x0, nFileSizeLow=0xdb35, dwReserved0=0x0, dwReserved1=0x0, cFileName="cZ3IrleIfhgfpzwI6trs.wav", cAlternateFileName="CZ3IRL~1.WAV")) returned 1 [0341.338] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x5e10d913, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x5e10d913, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x5e15b5d5, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x3ac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3d9.dll", cAlternateFileName="")) returned 1 [0341.338] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4ff990, ftCreationTime.dwHighDateTime=0x1da47c5, ftLastAccessTime.dwLowDateTime=0x5e8b7890, ftLastAccessTime.dwHighDateTime=0x1da4a87, ftLastWriteTime.dwLowDateTime=0x5e8b7890, ftLastWriteTime.dwHighDateTime=0x1da4a87, nFileSizeHigh=0x0, nFileSizeLow=0x3657, dwReserved0=0x0, dwReserved1=0x0, cFileName="D4BI.mp3", cAlternateFileName="")) returned 1 [0341.339] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc38662e0, ftCreationTime.dwHighDateTime=0x1da46ff, ftLastAccessTime.dwLowDateTime=0x86c74200, ftLastAccessTime.dwHighDateTime=0x1da4850, ftLastWriteTime.dwLowDateTime=0x86c74200, ftLastWriteTime.dwHighDateTime=0x1da4850, nFileSizeHigh=0x0, nFileSizeLow=0x1ab6, dwReserved0=0x0, dwReserved1=0x0, cFileName="dTMVJ74x_.jpg", cAlternateFileName="DTMVJ7~1.JPG")) returned 1 [0341.339] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34d0b40, ftCreationTime.dwHighDateTime=0x1da3e1d, ftLastAccessTime.dwLowDateTime=0xe5bce750, ftLastAccessTime.dwHighDateTime=0x1da4810, ftLastWriteTime.dwLowDateTime=0xe5bce750, ftLastWriteTime.dwHighDateTime=0x1da4810, nFileSizeHigh=0x0, nFileSizeLow=0x12004, dwReserved0=0x0, dwReserved1=0x0, cFileName="fHxdY pyFmyJ50aGNZK.mp3", cAlternateFileName="FHXDYP~1.MP3")) returned 1 [0341.339] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d3bb50, ftCreationTime.dwHighDateTime=0x1da44bb, ftLastAccessTime.dwLowDateTime=0xede6fa20, ftLastAccessTime.dwHighDateTime=0x1da4562, ftLastWriteTime.dwLowDateTime=0xede6fa20, ftLastWriteTime.dwHighDateTime=0x1da4562, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fsz635 DlIIMkDVqQ.mkv", cAlternateFileName="FSZ635~1.MKV")) returned 1 [0341.339] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb255a80, ftCreationTime.dwHighDateTime=0x1da48c2, ftLastAccessTime.dwLowDateTime=0xb37e4bf0, ftLastAccessTime.dwHighDateTime=0x1da499e, ftLastWriteTime.dwLowDateTime=0xb37e4bf0, ftLastWriteTime.dwHighDateTime=0x1da499e, nFileSizeHigh=0x0, nFileSizeLow=0x5610, dwReserved0=0x0, dwReserved1=0x0, cFileName="HXgKdXinFbnBL.mp3", cAlternateFileName="HXGKDX~1.MP3")) returned 1 [0341.340] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9adb1b0, ftCreationTime.dwHighDateTime=0x1da4545, ftLastAccessTime.dwLowDateTime=0xe2c39d90, ftLastAccessTime.dwHighDateTime=0x1da4a0a, ftLastWriteTime.dwLowDateTime=0xe2c39d90, ftLastWriteTime.dwHighDateTime=0x1da4a0a, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JKNh-WJ7rEele.png", cAlternateFileName="JKNH-W~1.PNG")) returned 1 [0341.340] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe90d690, ftCreationTime.dwHighDateTime=0x1da4952, ftLastAccessTime.dwLowDateTime=0x93f68730, ftLastAccessTime.dwHighDateTime=0x1da4966, ftLastWriteTime.dwLowDateTime=0x93f68730, ftLastWriteTime.dwHighDateTime=0x1da4966, nFileSizeHigh=0x0, nFileSizeLow=0x1145, dwReserved0=0x0, dwReserved1=0x0, cFileName="jXXIIV8eZ3.wav", cAlternateFileName="JXXIIV~1.WAV")) returned 1 [0341.341] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e6eea0, ftCreationTime.dwHighDateTime=0x1da4582, ftLastAccessTime.dwLowDateTime=0x4cb874e0, ftLastAccessTime.dwHighDateTime=0x1da4700, ftLastWriteTime.dwLowDateTime=0x4cb874e0, ftLastWriteTime.dwHighDateTime=0x1da4700, nFileSizeHigh=0x0, nFileSizeLow=0xeb7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jYyKZ g26P.bmp", cAlternateFileName="JYYKZG~1.BMP")) returned 1 [0341.341] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f2d9300, ftCreationTime.dwHighDateTime=0x1da4495, ftLastAccessTime.dwLowDateTime=0xb2ffd740, ftLastAccessTime.dwHighDateTime=0x1da4a19, ftLastWriteTime.dwLowDateTime=0xb2ffd740, ftLastWriteTime.dwHighDateTime=0x1da4a19, nFileSizeHigh=0x0, nFileSizeLow=0x7c10, dwReserved0=0x0, dwReserved1=0x0, cFileName="KQMbs6_s.mp3", cAlternateFileName="")) returned 1 [0341.341] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88851810, ftCreationTime.dwHighDateTime=0x1da4823, ftLastAccessTime.dwLowDateTime=0xd83cc10, ftLastAccessTime.dwHighDateTime=0x1da4891, ftLastWriteTime.dwLowDateTime=0xd83cc10, ftLastWriteTime.dwHighDateTime=0x1da4891, nFileSizeHigh=0x0, nFileSizeLow=0xc9dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF_3PnCR_.pptx", cAlternateFileName="MF_3PN~1.PPT")) returned 1 [0341.341] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa92f1c4e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa92f1c4e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0341.342] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f6a6e0, ftCreationTime.dwHighDateTime=0x1da48a6, ftLastAccessTime.dwLowDateTime=0xeabf1e00, ftLastAccessTime.dwHighDateTime=0x1da4917, ftLastWriteTime.dwLowDateTime=0xeabf1e00, ftLastWriteTime.dwHighDateTime=0x1da4917, nFileSizeHigh=0x0, nFileSizeLow=0x12fff, dwReserved0=0x0, dwReserved1=0x0, cFileName="MNSym8GbQK-8.swf", cAlternateFileName="MNSYM8~1.SWF")) returned 1 [0341.342] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9039fc0, ftCreationTime.dwHighDateTime=0x1da42df, ftLastAccessTime.dwLowDateTime=0x1c73fc40, ftLastAccessTime.dwHighDateTime=0x1da4a85, ftLastWriteTime.dwLowDateTime=0x1c73fc40, ftLastWriteTime.dwHighDateTime=0x1da4a85, nFileSizeHigh=0x0, nFileSizeLow=0x12d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrqwfoRtNNb3MCYZq.mp4", cAlternateFileName="MRQWFO~1.MP4")) returned 1 [0341.342] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ea8aba0, ftCreationTime.dwHighDateTime=0x1da483e, ftLastAccessTime.dwLowDateTime=0xd3bb4170, ftLastAccessTime.dwHighDateTime=0x1da498a, ftLastWriteTime.dwLowDateTime=0xd3bb4170, ftLastWriteTime.dwHighDateTime=0x1da498a, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MT45I6KA.mkv", cAlternateFileName="")) returned 1 [0341.343] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0341.343] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183ae480, ftCreationTime.dwHighDateTime=0x1da3b31, ftLastAccessTime.dwLowDateTime=0x34196240, ftLastAccessTime.dwHighDateTime=0x1da3b67, ftLastWriteTime.dwLowDateTime=0x34196240, ftLastWriteTime.dwHighDateTime=0x1da3b67, nFileSizeHigh=0x0, nFileSizeLow=0x8cb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="tfuCOR.odp", cAlternateFileName="")) returned 1 [0341.343] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e62a860, ftCreationTime.dwHighDateTime=0x1da42a0, ftLastAccessTime.dwLowDateTime=0x36893490, ftLastAccessTime.dwHighDateTime=0x1da448d, ftLastWriteTime.dwLowDateTime=0x36893490, ftLastWriteTime.dwHighDateTime=0x1da448d, nFileSizeHigh=0x0, nFileSizeLow=0x13443, dwReserved0=0x0, dwReserved1=0x0, cFileName="u-fr59qMhq iNbXNswh.jpg", cAlternateFileName="U-FR59~1.JPG")) returned 1 [0341.343] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2866010, ftCreationTime.dwHighDateTime=0x1da3f05, ftLastAccessTime.dwLowDateTime=0xb7ee0780, ftLastAccessTime.dwHighDateTime=0x1da49b1, ftLastWriteTime.dwLowDateTime=0xb7ee0780, ftLastWriteTime.dwHighDateTime=0x1da49b1, nFileSizeHigh=0x0, nFileSizeLow=0x14356, dwReserved0=0x0, dwReserved1=0x0, cFileName="u1wFm3.mp3", cAlternateFileName="")) returned 1 [0341.344] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb55bac0, ftCreationTime.dwHighDateTime=0x1da3c2f, ftLastAccessTime.dwLowDateTime=0xc6fbc200, ftLastAccessTime.dwHighDateTime=0x1da42b6, ftLastWriteTime.dwLowDateTime=0xc6fbc200, ftLastWriteTime.dwHighDateTime=0x1da42b6, nFileSizeHigh=0x0, nFileSizeLow=0xe3e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="uslcCy_K RfTo7ve5.mp4", cAlternateFileName="USLCCY~1.MP4")) returned 1 [0341.344] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9239bc30, ftCreationTime.dwHighDateTime=0x1da3ae5, ftLastAccessTime.dwLowDateTime=0x8165ad60, ftLastAccessTime.dwHighDateTime=0x1da4aa3, ftLastWriteTime.dwLowDateTime=0x8165ad60, ftLastWriteTime.dwHighDateTime=0x1da4aa3, nFileSizeHigh=0x0, nFileSizeLow=0x3e8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="vYPvixEglgn.mp3", cAlternateFileName="VYPVIX~1.MP3")) returned 1 [0341.345] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41db1ef0, ftCreationTime.dwHighDateTime=0x1da4058, ftLastAccessTime.dwLowDateTime=0x922729e0, ftLastAccessTime.dwHighDateTime=0x1da405c, ftLastWriteTime.dwLowDateTime=0x922729e0, ftLastWriteTime.dwHighDateTime=0x1da405c, nFileSizeHigh=0x0, nFileSizeLow=0x187b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="XhT_sAmLDRYKU5DO8Y.m4a", cAlternateFileName="XHT_SA~1.M4A")) returned 1 [0341.345] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55d8bf0, ftCreationTime.dwHighDateTime=0x1da4422, ftLastAccessTime.dwLowDateTime=0x8a798520, ftLastAccessTime.dwHighDateTime=0x1da4a80, ftLastWriteTime.dwLowDateTime=0x8a798520, ftLastWriteTime.dwHighDateTime=0x1da4a80, nFileSizeHigh=0x0, nFileSizeLow=0x13854, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4kuXGGVRki.xls", cAlternateFileName="Y4KUXG~1.XLS")) returned 1 [0341.345] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96836fa0, ftCreationTime.dwHighDateTime=0x1da3aec, ftLastAccessTime.dwLowDateTime=0xa0ca3230, ftLastAccessTime.dwHighDateTime=0x1da49a8, ftLastWriteTime.dwLowDateTime=0xa0ca3230, ftLastWriteTime.dwHighDateTime=0x1da49a8, nFileSizeHigh=0x0, nFileSizeLow=0x4725, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIOM6k46mGfb_44KXpyk.wav", cAlternateFileName="ZIOM6K~1.WAV")) returned 1 [0341.346] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96836fa0, ftCreationTime.dwHighDateTime=0x1da3aec, ftLastAccessTime.dwLowDateTime=0xa0ca3230, ftLastAccessTime.dwHighDateTime=0x1da49a8, ftLastWriteTime.dwLowDateTime=0xa0ca3230, ftLastWriteTime.dwHighDateTime=0x1da49a8, nFileSizeHigh=0x0, nFileSizeLow=0x4725, dwReserved0=0x0, dwReserved1=0x0, cFileName="zIOM6k46mGfb_44KXpyk.wav", cAlternateFileName="ZIOM6K~1.WAV")) returned 0 [0341.346] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea7c) returned 1 [0341.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea88) returned 1 [0341.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0341.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x2c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0341.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0341.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x2c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0341.347] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.349] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.350] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0341.350] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0341.350] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0341.351] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x2c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0341.351] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.351] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.351] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0341.352] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.352] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0341.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0341.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0341.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0341.352] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\adobe\\flash player\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.353] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.353] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0341.353] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 0 [0341.353] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0341.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x30, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0341.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0341.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x30, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0341.354] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.354] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.354] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0341.355] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0341.355] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0341.355] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0341.356] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0341.356] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0341.356] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0341.356] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0341.356] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0341.357] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0341.357] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0341.357] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0341.357] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0341.358] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0341.358] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0341.358] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0341.358] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0341.358] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0 [0341.359] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x30 [0341.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x30, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0341.359] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.359] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.360] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0341.360] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0341.434] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0341.435] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa33cc5, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0341.436] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0341.437] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0341.437] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0341.437] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.437] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0341.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0341.438] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\addins\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.442] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.442] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.442] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0341.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0341.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.443] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0341.443] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x3d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0341.443] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\bibliography\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1df0 [0341.445] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.445] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80ed2ca5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0341.445] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80ed2ca5, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0341.445] FindClose (in: hFindFile=0x58f1df0 | out: hFindFile=0x58f1df0) returned 1 [0341.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0341.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0341.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0341.446] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x3c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0341.446] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\credentials\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.446] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.447] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.447] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0341.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x49, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0341.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0341.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x49, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0341.447] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\document building blocks\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.450] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.450] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0341.450] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0341.451] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0341.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0341.451] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\excel\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.452] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.453] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0341.453] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0341.453] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0341.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x42, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0341.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0341.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x42, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0341.454] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\internet explorer\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.454] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.454] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xea09ab5b, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xea09ab5b, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0341.455] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0341.455] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0341.455] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0341.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0341.456] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\mmc\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.466] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.466] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.466] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.466] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0341.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0341.467] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\network\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18f0 [0341.469] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.470] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0341.471] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0341.471] FindClose (in: hFindFile=0x58f18f0 | out: hFindFile=0x58f18f0) returned 1 [0341.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0341.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0341.471] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\office\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.473] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.473] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f81d62, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80f81d62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80f83167, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0341.473] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0341.473] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0341.474] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0341.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0341.474] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\outlook\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.475] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.475] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abbe5b6, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6abbe5b6, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x6acd6e90, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0341.475] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877953e5, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x877953e5, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8864a351, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x956, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0341.475] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.475] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0341.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0341.476] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\protect\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.476] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.477] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x542308e0, ftLastWriteTime.dwHighDateTime=0x1da4ac8, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0341.477] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8060823c, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x8060823c, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0341.477] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5433b954, ftLastWriteTime.dwHighDateTime=0x1da4ac8, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0341.477] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.477] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0341.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0341.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0341.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x39, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0341.478] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\spelling\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.479] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.479] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0341.480] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0341.480] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0341.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0341.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0341.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0341.480] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\systemcertificates\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.481] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.481] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0341.482] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0341.482] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0341.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0341.482] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.488] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x6aa33cc5, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.488] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d61fa7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96d61fa7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96d61fa7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveContent", cAlternateFileName="LIVECO~1")) returned 1 [0341.489] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4614163, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4614163, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa46a67ce, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4641, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0341.489] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.489] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0341.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0341.491] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\vault\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.493] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.493] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.493] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0341.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0341.494] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.494] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0341.495] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4a399123, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x4a399123, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0341.496] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8c427141, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8c473662, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0341.496] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0341.496] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0341.496] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0341.496] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0341.496] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0341.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0341.497] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\word\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.497] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.497] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x669f9558, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x669f9558, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0341.498] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x669f9558, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x669f9558, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x669f9558, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 0 [0341.498] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.498] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.498] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", lpFilePart=0x0) returned 0x29 [0341.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.498] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.498] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", lpFilePart=0x0) returned 0x29 [0341.498] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\sun\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.499] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.499] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0341.499] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0341.499] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun", lpFilePart=0x0) returned 0x29 [0341.499] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\sun\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18f0 [0341.499] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.500] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0341.500] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.500] FindClose (in: hFindFile=0x58f18f0 | out: hFindFile=0x58f18f0) returned 1 [0341.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", lpFilePart=0x0) returned 0x2e [0341.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java", lpFilePart=0x0) returned 0x2e [0341.500] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Sun\\Java\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\sun\\java\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.502] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.502] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0341.502] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb003583b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb003583b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb003583b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 0 [0341.502] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.503] CoTaskMemAlloc (cb=0x20c) returned 0x690b38 [0341.503] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x690b38 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0341.503] CoTaskMemFree (pv=0x690b38) [0341.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0341.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x24, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0341.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eac0) returned 1 [0341.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0341.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x24, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0341.503] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\*"), lpFindFileData=0x18e7e8 | out: lpFindFileData=0x18e7e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1c30 [0341.504] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.504] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0341.504] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0341.504] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x2e4f6a9d, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x991d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xddb04c43, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xddb04c43, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0341.505] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0341.506] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x526bdbb8, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x526bdbb8, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0341.506] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0341.506] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0341.506] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0341.506] FindNextFileW (in: hFindFile=0x58f1c30, lpFindFileData=0x18e7f4 | out: lpFindFileData=0x18e7f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.506] FindClose (in: hFindFile=0x58f1c30 | out: hFindFile=0x58f1c30) returned 1 [0341.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea7c) returned 1 [0341.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea88) returned 1 [0341.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0341.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.506] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0341.506] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.507] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.507] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.507] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0341.507] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.508] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.508] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.508] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0341.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0341.508] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\application data\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0341.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea74) returned 1 [0341.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0341.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0341.512] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1bf0 [0341.512] FindNextFileW (in: hFindFile=0x58f1bf0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.513] FindNextFileW (in: hFindFile=0x58f1bf0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0341.513] FindNextFileW (in: hFindFile=0x58f1bf0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0341.513] FindNextFileW (in: hFindFile=0x58f1bf0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0341.513] FindNextFileW (in: hFindFile=0x58f1bf0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0341.513] FindClose (in: hFindFile=0x58f1bf0 | out: hFindFile=0x58f1bf0) returned 1 [0341.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.514] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2a [0341.514] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x2a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0341.514] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.514] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.514] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0341.514] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0341.515] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0341.515] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.515] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0341.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0341.515] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x2f, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0341.515] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.516] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.516] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e26d5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0341.518] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.518] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.524] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0341.524] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0341.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.524] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0341.524] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0341.525] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.525] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.525] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.525] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0341.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0341.526] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.527] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.528] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1 [0341.528] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x9867d3ae, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1 [0341.528] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1 [0341.528] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0341.528] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0341.529] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1 [0341.529] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.529] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0341.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x2c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0341.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0341.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x2c, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0341.531] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\history\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0341.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea74) returned 1 [0341.534] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0341.534] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x2e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0341.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.535] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0341.535] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x2e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0341.535] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0xa282407e, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.536] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0xa282407e, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.537] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0341.537] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0341.538] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0341.538] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0341.538] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8143eb65, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x8143eb65, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0341.538] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0341.539] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0341.539] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0341.539] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0341.540] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0341.540] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3c6bda82, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x3c6bda82, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0341.540] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0341.541] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0341.541] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0341.541] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0341.542] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0341.542] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0341.542] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7714974e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7714974e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0341.542] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0341.543] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0341.543] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 1 [0341.543] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 0 [0341.544] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2e [0341.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x2e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0341.544] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa282407e, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa282407e, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.545] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa282407e, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa282407e, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.545] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0341.545] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0341.546] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0341.546] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x82fb51b0, ftLastWriteTime.dwHighDateTime=0x1d8a649, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0341.546] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8143eb65, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x8143eb65, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0341.546] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0341.546] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0341.547] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0341.547] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0341.547] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0341.547] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3c6bda82, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x3c6bda82, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0341.548] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0341.548] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0341.548] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0341.548] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0341.549] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0341.549] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0341.549] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7714974e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7714974e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0341.549] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0341.550] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0341.550] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windоws", cAlternateFileName="WINDWS~1")) returned 1 [0341.550] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.550] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0341.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.551] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0341.551] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.553] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.553] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0341.553] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0341.554] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0341.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0341.554] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.555] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.555] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0341.556] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0341.556] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0341.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0341.556] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.557] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.557] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0341.557] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0341.558] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0341.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0341.558] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x55ad3aca, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.559] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x55ad3aca, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.559] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x82fb51b0, ftLastAccessTime.dwHighDateTime=0x1d8a649, ftLastWriteTime.dwLowDateTime=0x55ad3aca, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.559] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0341.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0341.560] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8143eb65, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x8143eb65, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.560] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8143eb65, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x8143eb65, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.561] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8143eb65, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x8143eb65, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7d020aea, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0341.561] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x8129b125, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81418b80, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81418b80, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0341.561] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x8129b125, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81418b80, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81418b80, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0341.561] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0341.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0341.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x3a, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0341.562] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.563] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.563] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81464d30, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0ZHVPQ4C", cAlternateFileName="")) returned 1 [0341.563] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81464d30, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4LTAAQ6N", cAlternateFileName="")) returned 1 [0341.564] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81464d30, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8VSKEEV0", cAlternateFileName="")) returned 1 [0341.564] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x8129b125, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x8129b125, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x8129b125, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0341.564] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81464d30, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N59TJILT", cAlternateFileName="")) returned 1 [0341.565] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x81464d30, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x81464d30, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x81464d30, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="N59TJILT", cAlternateFileName="")) returned 0 [0341.565] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0341.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.566] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.566] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0341.566] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.567] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.567] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0341.568] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.568] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0341.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0341.569] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1770 [0341.569] FindNextFileW (in: hFindFile=0x58f1770, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.569] FindNextFileW (in: hFindFile=0x58f1770, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 1 [0341.570] FindNextFileW (in: hFindFile=0x58f1770, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.570] FindClose (in: hFindFile=0x58f1770 | out: hFindFile=0x58f1770) returned 1 [0341.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0341.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x42 [0341.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0341.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x43, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x42 [0341.571] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.571] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.572] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0341.572] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 0 [0341.572] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.573] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.573] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", lpFilePart=0x0) returned 0x3a [0341.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.573] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.573] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", lpFilePart=0x0) returned 0x3a [0341.573] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.574] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.574] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 1 [0341.574] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 0 [0341.574] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0341.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x40, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3f [0341.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0341.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x40, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3f [0341.575] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3c6bda82, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x4a8aa264, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1df0 [0341.576] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3c6bda82, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x4a8aa264, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.576] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4302da2a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4302da2a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430ec4ba, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0341.576] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c6bda82, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x3c6bda82, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x3c6bda82, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DomainSuggestions", cAlternateFileName="DOMAIN~1")) returned 1 [0341.577] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79116574, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x79116574, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x79116574, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieSiteList", cAlternateFileName="EMIESI~1")) returned 1 [0341.577] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79116574, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x79116574, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x79116574, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieUserList", cAlternateFileName="EMIEUS~1")) returned 1 [0341.577] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431ab1e5, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x431ab1e5, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x600a7168, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-ClearIconCache.log", cAlternateFileName="IE4UIN~2.LOG")) returned 1 [0341.577] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4137bbef, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x431128d7, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-UserConfig.log", cAlternateFileName="IE4UIN~1.LOG")) returned 1 [0341.578] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData", cAlternateFileName="IECOMP~1")) returned 1 [0341.578] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4a8aa264, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x4a8aa264, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x4a8aa264, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0341.578] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xad892634, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore", cAlternateFileName="IMAGES~1")) returned 1 [0341.579] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x742c124c, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x742c124c, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x742c124c, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0341.579] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabRoaming", cAlternateFileName="TABROA~1")) returned 1 [0341.579] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracking Protection", cAlternateFileName="TRACKI~1")) returned 1 [0341.580] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d3c838e, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x1dc930ab, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x1dc930ab, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 1 [0341.580] FindNextFileW (in: hFindFile=0x58f1df0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d3c838e, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0x1dc930ab, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x1dc930ab, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 0 [0341.580] FindClose (in: hFindFile=0x58f1df0 | out: hFindFile=0x58f1df0) returned 1 [0341.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x3a [0341.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.581] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x3a [0341.581] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Media Player\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\media player\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.582] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.582] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0341.582] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0341.583] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x760d4d6f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x760d4d6f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x760d4d6f, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0341.583] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.583] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.583] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x34 [0341.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.584] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x35 [0341.584] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x35, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x34 [0341.584] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Office\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\office\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.584] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.585] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x3b96fdbf, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3b96fdbf, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0", cAlternateFileName="")) returned 1 [0341.585] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xb80a5845, ftLastAccessTime.dwHighDateTime=0x1d99cf8, ftLastWriteTime.dwLowDateTime=0xb80a5845, ftLastWriteTime.dwHighDateTime=0x1d99cf8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTele", cAlternateFileName="")) returned 1 [0341.585] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x696efe32, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0xb80a5845, ftLastAccessTime.dwHighDateTime=0x1d99cf8, ftLastWriteTime.dwLowDateTime=0xb80a5845, ftLastWriteTime.dwHighDateTime=0x1d99cf8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OTele", cAlternateFileName="")) returned 0 [0341.585] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", lpFilePart=0x0) returned 0x36 [0341.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0341.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", nBufferLength=0x37, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive", lpFilePart=0x0) returned 0x36 [0341.586] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.589] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.589] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x883c79d5, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x973d65a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x980cd2db, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626", cAlternateFileName="173589~1.062")) returned 1 [0341.589] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13a98591, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x27e196bc, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x27e196bc, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_1", cAlternateFileName="173589~2.062")) returned 1 [0341.590] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf111177, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x19a81fc0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x1bc7bb71, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_2", cAlternateFileName="173589~3.062")) returned 1 [0341.590] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4be92b64, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x6abcad0b, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x6aeebefe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_3", cAlternateFileName="173589~4.062")) returned 1 [0341.590] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2a1d565, ftCreationTime.dwHighDateTime=0x1d70073, ftLastAccessTime.dwLowDateTime=0xb2c68d12, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.5892.0626_4", cAlternateFileName="177A54~1.062")) returned 1 [0341.590] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b49234, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b49234, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0341.591] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b49234, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b49234, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0341.591] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.592] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.592] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x35 [0341.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.592] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.593] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x35 [0341.593] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Outlook\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\outlook\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.593] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.594] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11cf49, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a11cf49, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a11cf49, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gliding", cAlternateFileName="")) returned 1 [0341.594] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a2bfc, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0341.594] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x847a2bfc, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0341.595] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", lpFilePart=0x0) returned 0x37 [0341.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0341.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", nBufferLength=0x38, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady", lpFilePart=0x0) returned 0x37 [0341.596] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\PlayReady\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\playready\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.596] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.597] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0341.597] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0341.597] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.598] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", lpFilePart=0x0) returned 0x33 [0341.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.598] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0341.598] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", nBufferLength=0x34, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault", lpFilePart=0x0) returned 0x33 [0341.598] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Vault\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\vault\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.598] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.598] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb8beb5c, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb8beb5c, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb8beb5c, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BF4C442-9B8A-41A0-B380-DD4A704DDB28", cAlternateFileName="4BF4C4~1")) returned 1 [0341.599] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9574d8, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb9574d8, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserProfileRoaming", cAlternateFileName="USERPR~1")) returned 1 [0341.599] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb9574d8, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb9574d8, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserProfileRoaming", cAlternateFileName="USERPR~1")) returned 0 [0341.599] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.599] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x35 [0341.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x35 [0341.600] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7714974e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7714974e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.600] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7714974e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7714974e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.601] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2423f479, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2423f479, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2423f479, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0", cAlternateFileName="")) returned 1 [0341.601] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd4d9a492, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xd4d9a492, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xd4d9a492, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0341.601] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37d807a2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x69922d1c, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x69922d1c, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionCenterCache", cAlternateFileName="ACTION~1")) returned 1 [0341.601] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f810a8a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3f810a8a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43695fb2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application Shortcuts", cAlternateFileName="APPLIC~1")) returned 1 [0341.601] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81988c19, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xa2cd8e8d, ftLastAccessTime.dwHighDateTime=0x1d8a64b, ftLastWriteTime.dwLowDateTime=0xa2cd8e8d, ftLastWriteTime.dwHighDateTime=0x1d8a64b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1 [0341.602] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f7a181e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x1ec09b64, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x1ec09b64, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0341.602] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f6df80c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaed678f3, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaed678f3, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1 [0341.602] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0341.602] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f959ee, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4f959ee, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0341.602] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x732ba2e1, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x732ba2e1, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0341.603] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x73302203, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x73302203, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatUaCache", cAlternateFileName="IECOMP~2")) returned 1 [0341.603] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7714974e, ftCreationTime.dwHighDateTime=0x1da4ad4, ftLastAccessTime.dwLowDateTime=0x7714974e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x7714974e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEDownloadHistory", cAlternateFileName="IEDOWN~1")) returned 1 [0341.603] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x666043d7, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x666043d7, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0341.603] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x47136f8d, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x47136f8d, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0341.604] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xafc9a821, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xafc9a821, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xafc9a821, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notifications", cAlternateFileName="NOTIFI~1")) returned 1 [0341.604] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x47cd6d9c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x47cd6d9c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x47cd6d9c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0341.604] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x400db452, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xab1ccb9c, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xab1ccb9c, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRICache", cAlternateFileName="")) returned 1 [0341.604] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0341.604] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingTiles", cAlternateFileName="ROAMIN~1")) returned 1 [0341.605] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9586b313, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x95891577, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x95891577, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingSync", cAlternateFileName="SETTIN~1")) returned 1 [0341.605] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0341.605] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0341.605] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f5ae5bb, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2530723e, ftLastAccessTime.dwHighDateTime=0x1da4ad4, ftLastWriteTime.dwLowDateTime=0x2530723e, ftLastWriteTime.dwHighDateTime=0x1da4ad4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UPPS", cAlternateFileName="")) returned 1 [0341.605] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x3d51879a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x58a6b679, ftLastAccessTime.dwHighDateTime=0x1da4ac8, ftLastWriteTime.dwLowDateTime=0x58a6b679, ftLastWriteTime.dwHighDateTime=0x1da4ac8, nFileSizeHigh=0x0, nFileSizeLow=0x240000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d51879a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d51879a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d51879a, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x186000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d51879a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d51879a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d51879a, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x9f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d51879a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d51879a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6345aa97, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{6c1df322-6c5b-11eb-b0a5-00053a318d5c}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d53e9ee, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d53e9ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x63434853, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{6c1df322-6c5b-11eb-b0a5-00053a318d5c}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d564ab0, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d564ab0, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6345aa97, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat{6c1df322-6c5b-11eb-b0a5-00053a318d5c}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0341.606] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x9d9e8d0b, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0x9d9e8d0b, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCache", cAlternateFileName="")) returned 1 [0341.607] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3f28d414, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3f28d414, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCacheLock.dat", cAlternateFileName="WEBCAC~1.DAT")) returned 1 [0341.607] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 1 [0341.607] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 0 [0341.607] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", lpFilePart=0x0) returned 0x3a [0341.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0341.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x3b, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", lpFilePart=0x0) returned 0x3a [0341.608] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows live\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f16f0 [0341.611] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.611] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bici", cAlternateFileName="")) returned 1 [0341.611] FindNextFileW (in: hFindFile=0x58f16f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bici", cAlternateFileName="")) returned 0 [0341.611] FindClose (in: hFindFile=0x58f16f0 | out: hFindFile=0x58f16f0) returned 1 [0341.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.611] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0341.611] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x3e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x3d [0341.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.612] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0341.612] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x3e, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x3d [0341.612] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows sidebar\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.612] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.612] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0341.613] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d053a9f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d053a9f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0341.613] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.613] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0341.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0341.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", nBufferLength=0x36, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws", lpFilePart=0x0) returned 0x35 [0341.613] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windоws\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windоws\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.614] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.614] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa27ffe36, ftCreationTime.dwHighDateTime=0x1dab861, ftLastAccessTime.dwLowDateTime=0xa27ffe36, ftLastAccessTime.dwHighDateTime=0x1dab861, ftLastWriteTime.dwLowDateTime=0xa27ffe36, ftLastWriteTime.dwHighDateTime=0x1dab861, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.614] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0341.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x32 [0341.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0341.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x32 [0341.615] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft help\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f19f0 [0341.615] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.615] FindNextFileW (in: hFindFile=0x58f19f0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.615] FindClose (in: hFindFile=0x58f19f0 | out: hFindFile=0x58f19f0) returned 1 [0341.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.616] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0341.616] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", nBufferLength=0x33, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x32 [0341.616] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft Help\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft help\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.616] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.616] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0341.616] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0341.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", lpFilePart=0x0) returned 0x31 [0341.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0341.617] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", lpFilePart=0x0) returned 0x31 [0341.617] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoftedge\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18f0 [0341.623] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.623] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1 [0341.624] FindNextFileW (in: hFindFile=0x58f18f0, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 0 [0341.624] FindClose (in: hFindFile=0x58f18f0 | out: hFindFile=0x58f18f0) returned 1 [0341.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.624] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0341.624] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", nBufferLength=0x32, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge", lpFilePart=0x0) returned 0x31 [0341.624] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoftedge\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f18b0 [0341.624] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.625] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedCacheContainers", cAlternateFileName="SHARED~1")) returned 1 [0341.625] FindNextFileW (in: hFindFile=0x58f18b0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0341.625] FindClose (in: hFindFile=0x58f18b0 | out: hFindFile=0x58f18b0) returned 1 [0341.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e8) returned 1 [0341.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9f4) returned 1 [0341.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0341.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", nBufferLength=0x48, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", lpFilePart=0x0) returned 0x47 [0341.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea1c) returned 1 [0341.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x48 [0341.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", nBufferLength=0x48, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers", lpFilePart=0x0) returned 0x47 [0341.625] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MicrosoftEdge\\SharedCacheContainers\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoftedge\\sharedcachecontainers\\*"), lpFindFileData=0x18e744 | out: lpFindFileData=0x18e744*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x435d739, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.626] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x435d739, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.627] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4278a87, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4278a87, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4278a87, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompat", cAlternateFileName="MICROS~1")) returned 1 [0341.627] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x435d739, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x43f61d3, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x43f61d3, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 1 [0341.627] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e750 | out: lpFindFileData=0x18e750*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x435d739, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x43f61d3, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x43f61d3, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge_iecompatua", cAlternateFileName="MICROS~2")) returned 0 [0341.627] FindClose (in: hFindFile=0x58f1db0 | out: hFindFile=0x58f1db0) returned 1 [0341.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9d8) returned 1 [0341.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18e9e4) returned 1 [0341.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0341.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x2d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", lpFilePart=0x0) returned 0x2c [0341.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18eab0) returned 1 [0341.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0341.628] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x2d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", lpFilePart=0x0) returned 0x2c [0341.628] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\*"), lpFindFileData=0x18e7d8 | out: lpFindFileData=0x18e7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xdecc0441, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdecc0441, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1b70 [0341.628] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xdecc0441, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdecc0441, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.629] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54746ebf, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x547df81c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x548ea798, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1 [0341.629] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61156378, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x611c8b13, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x611c8b13, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1 [0341.629] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e7503f8, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4e9402ca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4e9402ca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62527d6a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6278a182, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6278a182, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87fe09a0, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x88079316, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x88079316, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc51817, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbc9dcff, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbc9dcff, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1 [0341.630] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89c56a54, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89c56a54, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7f62ab, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a9bfe3d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CON")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x60629330, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x60629330, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bcf8c41, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bd4522e, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8bd4522e, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a85f54c, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a91e2d1, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b1c2a8e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0341.631] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97d7ec6c, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97ed6108, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x97ed6108, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d549b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5a147a84, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5a147a84, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SHE")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563adc86, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x56afae31, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56afae31, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsCalculator_8wekyb3d8bbwe", cAlternateFileName="MIB609~1.WIN")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9989d823, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9993618c, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9993618c, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsFeedback_cw5n1h2txyewy", cAlternateFileName="MICROS~1.WIN")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9357b12, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x93f064f, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x9783e1e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WindowsStore_8wekyb3d8bbwe", cAlternateFileName="MICROS~4.WIN")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bdb8021, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9be50bc7, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9be50bc7, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxGameCallableUI_cw5n1h2txyewy", cAlternateFileName="MICROS~1.XBO")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9d41224c, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9d45e7c4, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9d759694, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.XboxIdentityProvider_cw5n1h2txyewy", cAlternateFileName="MICROS~2.XBO")) returned 1 [0341.632] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e49c81d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9e55b288, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9e55b288, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.ContactSupport_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.CON")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b6deebf, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0x1b6deebf, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x1b79dad4, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.devicesflow_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.DEV")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5efa8e98, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5efa8e98, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5efcf224, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows.immersivecontrolpanel_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.IMM")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f847eb6, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9f847eb6, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9f847eb6, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.MiracastView_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.MIR")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa05b11cd, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xa05b11cd, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xa05b11cd, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.PrintDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PRI")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab3706b2, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xab58681a, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xab58681a, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows.PurchaseDialog_cw5n1h2txyewy", cAlternateFileName="WINDOW~1.PUR")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 1 [0341.633] FindNextFileW (in: hFindFile=0x58f1b70, lpFindFileData=0x18e7e4 | out: lpFindFileData=0x18e7e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="windows_ie_ac_001", cAlternateFileName="WINDOW~1")) returned 0 [0341.633] FindClose (in: hFindFile=0x58f1b70 | out: hFindFile=0x58f1b70) returned 1 [0341.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea6c) returned 1 [0341.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x18ea78) returned 1 [0341.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x18ea2c) returned 1 [0341.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2d [0341.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", nBufferLength=0x2d, lpBuffer=0x6b3dd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages", lpFilePart=0x0) returned 0x2c [0341.634] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\*"), lpFindFileData=0x18e754 | out: lpFindFileData=0x18e754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xdecc0441, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdecc0441, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x58f1db0 [0341.634] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xdecc0441, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdecc0441, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0341.634] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54746ebf, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x547df81c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x548ea798, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BRO")) returned 1 [0341.634] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61156378, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x611c8b13, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x611c8b13, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AccountsControl_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ACC")) returned 1 [0341.634] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e7503f8, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4e9402ca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4e9402ca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BioEnrollment_cw5n1h2txyewy", cAlternateFileName="MICROS~1.BIO")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62527d6a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6278a182, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6278a182, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.LockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.LOC")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87fe09a0, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x88079316, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x88079316, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MicrosoftEdge_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.MIC")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~2.1_8")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.1_8")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdbc51817, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdbc9dcff, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbc9dcff, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VCLibs.140.00_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.00_")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89c56a54, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89c56a54, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy", cAlternateFileName="MICROS~1.ASS")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CLO")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7f62ab, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a9bfe3d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy", cAlternateFileName="MICROS~1.CON")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x60629330, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x60629330, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_cw5n1h2txyewy", cAlternateFileName="MICROS~1.COR")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bcf8c41, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bd4522e, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8bd4522e, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.ParentalControls_cw5n1h2txyewy", cAlternateFileName="MICROS~1.PAR")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a85f54c, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a91e2d1, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b1c2a8e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Photos_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.PHO")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97d7ec6c, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97ed6108, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x97ed6108, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.SecondaryTileExperience_cw5n1h2txyewy", cAlternateFileName="MICROS~1.SEC")) returned 1 [0341.635] FindNextFileW (in: hFindFile=0x58f1db0, lpFindFileData=0x18e760 | out: lpFindFileData=0x18e760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a0d549b, ftCreationTime.dwHighDateTime=0x1d70068,